Details of VAR-202011-0285

ID

VAR-202011-0285

CVE

CVE-2020-17494

TITLE

Untangle Firewall NG Vulnerability in using cryptographic algorithms in

Trust: 0.8

sources: JVNDB: JVNDB-2020-013468

DESCRIPTION

Untangle Firewall NG before 16.0 uses MD5 for passwords. The application supports spam blocking, web filtering, anti-virus, anti-spyware, intrusion prevention, virtual private network, SSL virtual private network, firewall and other functions, and provides a web-based control interface

Trust: 1.71

sources: NVD: CVE-2020-17494 // JVNDB: JVNDB-2020-013468 // VULHUB: VHN-170678

AFFECTED PRODUCTS

vendor:	untangle	model:	firewall ng	scope:	lt	version:	16.0	Trust: 1.0
vendor:	untangle	model:	ng firewall	scope:	eq	version:	16.0	Trust: 0.8
vendor:	untangle	model:	ng firewall	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-013468 // NVD: CVE-2020-17494

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-17494
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-17494
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202011-955
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-170678
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-17494
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-170678
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-17494
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2020-17494
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-170678 // JVNDB: JVNDB-2020-013468 // CNNVD: CNNVD-202011-955 // NVD: CVE-2020-17494

PROBLEMTYPE DATA

problemtype:	CWE-326	Trust: 1.1
problemtype:	Use of incomplete or dangerous cryptographic algorithms (CWE-327) [NVD Evaluation ]	Trust: 0.8
problemtype:	CWE-327	Trust: 0.1

sources: VULHUB: VHN-170678 // JVNDB: JVNDB-2020-013468 // NVD: CVE-2020-17494

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202011-955

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-202011-955

PATCH

title:	16.0.0 - 16.0.1 Changelog	url:	https://github.com/untangle/ngfw_src/blob/1d232efe2c17a8838b59bbbeaf166dafa94676af/uvm/hier/usr/share/untangle/web/auth/index.py#L196-L200	Trust: 0.8
title:	Untangle Firewall NG Fixes for encryption problem vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=135137	Trust: 0.6

sources: JVNDB: JVNDB-2020-013468 // CNNVD: CNNVD-202011-955

EXTERNAL IDS

db:	NVD	id:	CVE-2020-17494	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-013468	Trust: 0.8
db:	CNNVD	id:	CNNVD-202011-955	Trust: 0.6
db:	VULHUB	id:	VHN-170678	Trust: 0.1

sources: VULHUB: VHN-170678 // JVNDB: JVNDB-2020-013468 // CNNVD: CNNVD-202011-955 // NVD: CVE-2020-17494

REFERENCES

url:	https://github.com/untangle/ngfw_src/blob/1d232efe2c17a8838b59bbbeaf166dafa94676af/uvm/hier/usr/share/untangle/web/auth/index.py#l196-l200	Trust: 1.7
url:	https://pastebin.com/s7uyg3vx	Trust: 1.7
url:	https://wiki.untangle.com/index.php/16.0.0_-_16.0.1_changelog	Trust: 1.7
url:	https://github.com/untangle/ngfw_src/search?q=author%3abmastbergen+committer-date%3a2020-08-10&type=commits	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-17494	Trust: 1.4
url:	https://github.com/untangle/ngfw_src/search?q=author%3abmastbergen+committer-date%3a2020-08-10&type=commits	Trust: 0.1

sources: VULHUB: VHN-170678 // JVNDB: JVNDB-2020-013468 // CNNVD: CNNVD-202011-955 // NVD: CVE-2020-17494

SOURCES

db:	VULHUB	id:	VHN-170678
db:	JVNDB	id:	JVNDB-2020-013468
db:	CNNVD	id:	CNNVD-202011-955
db:	NVD	id:	CVE-2020-17494

LAST UPDATE DATE

2024-11-23T22:44:24.353000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-170678	date:	2021-07-21T00:00:00
db:	JVNDB	id:	JVNDB-2020-013468	date:	2021-07-06T09:13:00
db:	CNNVD	id:	CNNVD-202011-955	date:	2021-08-16T00:00:00
db:	NVD	id:	CVE-2020-17494	date:	2024-11-21T05:08:13.317

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-170678	date:	2020-11-12T00:00:00
db:	JVNDB	id:	JVNDB-2020-013468	date:	2021-07-06T00:00:00
db:	CNNVD	id:	CNNVD-202011-955	date:	2020-11-12T00:00:00
db:	NVD	id:	CVE-2020-17494	date:	2020-11-12T21:15:10.840