ID

VAR-202004-0525

CVE

CVE-2020-12134

TITLE

Nanometrics Centaur and TitanSMA Vulnerability regarding lack of resource release after valid lifetime in

DESCRIPTION

Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log. Nanometrics Centaur and TitanSMA Is vulnerable to a lack of resource release after a valid lifetime.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Nanometrics Centaur and Nanometrics TitanSMA are both data loggers from Nanometrics, Canada. There are security vulnerabilities in Nanometrics Centaur 4.3.23 and earlier versions and TitanSMA 4.2.20 and earlier versions. No detailed vulnerability details are currently provided. The Centaur digital recorder is a portable geophysical sensing acquisition system that consists of a high-resolution 24-bit ADC, a precision GNSS-based clock, and removable storage capabilities. Its ease of use simplifies high performance geophysical sensing deployments in both remote and networked environments. Optimized for seismicity monitoring, the Centaur is also well-suited for infrasound and similar geophysical sensor recording applications requiring sample rates up to 5000 sps.<br/><br/> The TitanSMA is a strong motion accelerograph designed for high precision observational and structural engineering applications, where scientists and engineers require exceptional dynamic range over a wide frequency band.An information disclosure vulnerability exists when Centaur and TitanSMA fail to properly protectcritical system logs such as 'syslog'. Additionally, the implemented Jetty version (9.4.z-SNAPSHOT)suffers from a memory leak of shared buffers that was (supposedly) patched in Jetty version 9.2.9.v20150224.As seen in the aforementioned products, the 'patched' version is still vulnerable to the buffer leakage.Chaining these vulnerabilities allows an unauthenticated adversary to remotely send malicious HTTPpackets, and cause the shared buffer to 'bleed' contents of shared memory and store these in systemlogs. Accessing these unprotected logfiles reveal parts of the leaked buffer (up to 17 bytes per sentpacket) which can be combined to leak sensitive data which can be used to perform session hijackingand authentication bypass scenarios.Tested on: Jetty 9.4.z-SNAPSHOT. Ignition is a powerful industrial application platform withfully integrated development tools for building SCADA, MES, and IIoTsolutions.Remote unauthenticated atackers are able to read arbitrary datafrom other HTTP sessions because Ignition uses a vulnerable Jetty server.When the Jetty web server receives a HTTP request, the below code is usedto parse through the HTTP headers and their associated values. The serverbegins by looping through each character for a given header value and checksthe following:<br/><br/>- On Line 1164, the server checks if the character is printable ASCII ornot a valid ASCII character.<br/>- On Line 1172, the server checks if the character is a space or tab.<br/>- On Line 1175, the server checks if the character is a line feed.<br/>- If the character is non-printable ASCII (or less than 0x20), then allof the checks above are skipped over and the code throws an 'IllegalCharacter'exception on line 1186, passing in the illegal character and a shared buffer.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code>File: jetty-http\src\main\java\org\eclipse\jetty\http\HttpParser.java<br/>---------------------------------------------------------------------------<br/>920: protected boolean parseHeaders(ByteBuffer buffer)<br/>921: {<br/>[..snip..]<br/>1163: case HEADER_VALUE:<br/>1164: if (ch&gt;HttpTokens.SPACE || ch&lt;0)<br/>1165: {<br/>1166: _string.append((char)(0xff&amp;ch));<br/>1167: _length=_string.length();<br/>1168: setState(State.HEADER_IN_VALUE);<br/>1169: break;<br/>1170: }<br/>1171:<br/>1172: if (ch==HttpTokens.SPACE || ch==HttpTokens.TAB)<br/>1173: break;<br/>1174:<br/>1175: if (ch==HttpTokens.LINE_FEED)<br/>1176: {<br/>1177: if (_length &gt; 0)<br/>1178: {<br/>1179: _value=null;<br/>1180: _valueString=(_valueString==null)?takeString():(_valueString+" "+takeString());<br/>1181: }<br/>1182: setState(State.HEADER);<br/>1183: break;<br/>1184: }<br/>1185:<br/>1186: throw new IllegalCharacter(ch,buffer);<br/></code><br/> --------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows 7 Professional SP1 (EN)Microsoft Windows 7 Ultimate SP1 (EN)Ubuntu Linux 14.04Mac OS XHP-UX ItaniumJetty(9.2.z-SNAPSHOT)Java/1.8.0_73Java/1.8.0_66

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Vulnerability discovered by byteGoblin

SOURCES

LAST UPDATE DATE

2024-11-23T22:07:43.059000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE