VARIoT IoT vulnerabilities database

IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.x before 1.0.0.4, when guest access is configured, allow remote authenticated users to obtain sensitive information by reading error messages in responses. IBM B2B Advanced Communication is a communications gateway product from IBM Corporation of the United States. An information disclosure vulnerability exists in IBM B2B Advanced Communications versions 1.0.0.2 and 1.0.0.3. The following products and versions are affected: IBM Multi-Enterprise Integration Gateway version 1.0 to version 1.0.0.1

HPE Networking Products, originally branded as Comware 5, Comware 7, H3C, or HP, allow remote attackers to bypass intended access restrictions or cause a denial of service via "Virtual routing and forwarding (VRF) hopping.". H3CComware is the core software platform of H3C and builds the foundation of its IP network products. H3CComware5/7 devices have security vulnerabilities. HP Network Products are prone to an unspecified remote denial-of-service vulnerability. Exploiting this issue allows remote attackers to trigger denial-of-service conditions and gain unauthorized access. This may aid in further attacks. Both HP H3C Comware 5 and 7 are network communication platforms of Hewlett-Packard (HP). The platform fully supports the IPv6 protocol, comprehensively enhances the MPLS service, supports MPLS TE (Traffic Engineering, traffic engineering) and adopts a unified open API interface mechanism. A security vulnerability exists in HP H3C Comware 5 and 7 appliances. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c04779492 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04779492 Version: 3 HPSBHF03419 rev.3 - HPE Networking Products, Remote Denial of Service (DoS), Unauthorized Access NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2015-12-18 Last Updated: 2016-01-29 Potential Security Impact: Remote Denial of Service (DoS), unauthorized access Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified in HPE Networking Products. Note: This vulnerability could be exploited remotely as a result of the following network interface conditions: VRF (Virtual Routing and Forwarding) is enabled. MPLS (Multiprotocol Label Switching) is disabled. MPLS-labeled packets are received that match FIB (Forwarding Information Base) entries. When all the above conditions exist, the interface could incorrectly forward the MPLS-labeled packets. References: CVE-2015-5434 SSRT102034 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Please refer to the RESOLUTION section below for a list of impacted products. Note: all product versions are impacted prior to the fixed versions listed. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-5434 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 The Hewlett Packard Enterprise Company thanks G. Geshev from MWR Labs. for reporting this issue to security-alert@hpe.com RESOLUTION HP has provided the following software updates to resolve the vulnerability in the HP Networking products listed. Family Fixed Version HP Branded Products Impacted H3C Branded Products Impacted MSR20 (Comware 5) R2514P01 or later JD432A HP A-MSR20-21 Router JD662A HP MSR20-20 Router JD663A HP A-MSR20-21 Router JD663B HP MSR20-21 Router JD664A HP MSR20-40 Router JF228A HP MSR20-40 Router JF283A) HP MSR20-20 Router N/A MSR20-1X (Comware 5) R2514P01 or later JD431A HP MSR20-10 Router JD667A HP MSR20-15 IW Multi-Service Router JD668A HP MSR20-13 Multi-Service Router JD669A HP MSR20-13 W Multi-Service Router JD670A HP MSR20-15 A Multi-Service Router JD671A HP MSR20-15 AW Multi-Service Router JD672A HP MSR20-15 I Multi-Service Router JD673A HP MSR20-11 Multi-Service Router JD674A HP MSR20-12 Multi-Service Router JD675A HP MSR20-12 W Multi-Service Router JD676A HP MSR20-12 T1 Multi-Service Router JF236A HP MSR20-15-I Router JF237A HP MSR20-15-A Router JF238A HP MSR20-15-I-W Router JF239A HP MSR20-11 Router JF240A HP MSR20-13 Router JF241A HP MSR20-12 Router JF806A HP MSR20-12-T Router JF807A HP MSR20-12-W Router JF808A HP MSR20-13-W Router JF809A HP MSR20-15-A-W Router JF817A HP MSR20-15 Router JG209A HP MSR20-12-T-W Router (NA) JG210A HP MSR20-13-W Router (NA) H3C MSR 20-15 Router Host(AC) 1 FE 4 LSW 1 H3C RT-MSR2015-AC-OVS-AW-H3 (0235A393) H3C RT-MSR2015-AC-OVS-I-H3 (0235A394) H3C RT-MSR2015-AC-OVS-IW-H3 (0235A38V) H3C MSR 20-11 (0235A31V) H3C MSR 20-12 (0235A32E) H3C MSR 20-12 T1 (0235A32B) H3C MSR 20-13 (0235A31W) H3C MSR 20-13 W (0235A31X) H3C MSR 20-15 A (0235A31Q) H3C MSR 20-15 A W (0235A31R) H3C MSR 20-15 I (0235A31N) H3C MSR 20-15 IW (0235A31P) H3C MSR20-12 W (0235A32G) MSR 30 (Comware 5) R2514P01 or later JD654A HP MSR30-60 POE Multi-Service Router JD657A HP MSR30-40 Multi-Service Router JD658A HP MSR30-60 Multi-Service Router JD660A HP MSR30-20 POE Multi-Service Router JD661A HP MSR30-40 POE Multi-Service Router JD666A HP MSR30-20 Multi-Service Router JF229A HP MSR30-40 Router JF230A HP MSR30-60 Router JF232A HP RTMSR3040-AC-OVSAS-H3 JF235A HP MSR30-20 DC Router JF284A HP MSR30-20 Router JF287A HP MSR30-40 DC Router JF801A HP MSR30-60 DC Router JF802A HP MSR30-20 PoE Router JF803A HP MSR30-40 PoE Router JF804A HP MSR30-60 PoE Router H3C MSR 30-20 Router (0235A328) H3C MSR 30-40 Router Host(DC) (0235A268) H3C RT-MSR3020-AC-POE-OVS-H3 (0235A322) H3C RT-MSR3020-DC-OVS-H3 (0235A267) H3C RT-MSR3040-AC-OVS-H (0235A299) H3C RT-MSR3040-AC-POE-OVS-H3 (0235A323) H3C RT-MSR3060-AC-OVS-H3 (0235A320) H3C RT-MSR3060-AC-POE-OVS-H3 (0235A296) H3C RT-MSR3060-DC-OVS-H3 (0235A269) H3C MSR 30-20 RTVZ33020AS Router Host(AC) (0235A20S) H3C MSR 30-20 (0235A19L) H3C MSR 30-20 POE (0235A239) H3C MSR 30-40 (0235A20J) H3C MSR 30-40 POE (0235A25R) H3C MSR 30-60 (0235A20K) H3C MSR 30-60 POE (0235A25S) H3C RT-MSR3040-AC-OVS-AS-H3 (0235A20V) MSR 30-16 (Comware 5) R2514P01 or later JD659A HP MSR30-16 POE Multi-Service Router JD665A HP MSR30-16 Multi-Service Router JF233A HP MSR30-16 Router JF234A HP MSR30-16 PoE Router H3C RT-MSR3016-AC-OVS-H3 (0235A327) H3C RT-MSR3016-AC-POE-OVS-H3 (0235A321) H3C MSR 30-16 (0235A237) H3C MSR 30-16 POE (0235A238) MSR 30-1X (Comware 5) R2514P01 or later JF800A HP MSR30-11 Router JF816A HP MSR30-10 2 FE /2 SIC /1 MIM MS Rtr JG182A HP MSR30-11E Router JG183A HP MSR30-11F Router JG184A HP MSR30-10 DC Router 2FE 2SIC 1XMIM 256DDR (0235A39H) H3C RT-MSR3011-AC-OVS-H3 (0235A29L) MSR 50 (Comware 5) R2514P01 or later JD433A HP MSR50-40 Router JD653A HP MSR50 Processor Module JD655A HP MSR50-40 Multi-Service Router JD656A HP MSR50-60 Multi-Service Router JF231A HP MSR50-60 Router JF285A HP MSR50-40 DC Router JF640A HP MSR50-60 Rtr Chassis w DC PwrSupply H3C MSR 50-40 Router (0235A297) H3C MSR5040-DCOVS-H3C (0235A20P) H3C RT-MSR5060-AC-OVS-H3 (0235A298) H3C MSR 50-40 Chassis (0235A20N) H3C MSR 50-60 Chassis (0235A20L) MSR 50-G2 (Comware 5) R2514P01 or later JD429A HP MSR50 G2 Processor Module JD429B HP MSR50 G2 Processor Module H3C H3C MSR 50 Processor Module-G2 (0231A84Q) H3C MSR 50 High Performance Main Processing Unit 3GE (Combo) 256F/1GD (0231A0KL) MSR 9XX (Comware 5) R2514P01 or later JF812A HP MSR900 Router JF813A HP MSR920 Router JF814A HP MSR900-W Router JF815A HP MSR920 2FEWAN/8FELAN/.11 b/g Rtr JG207A HP MSR900-W Router (NA) JG208A HP MSR920-W Router (NA) H3C MSR 900 Router with 802.11b/g 2 FE WAN 4 FE LAN 256DDR 802.11b (0235A0C2) H3C MSR 900 Router 2 FE WAN 4 FE LAN 256DDR (0235A0BX) H3C MSR 920 Router with 802.11b/g 2 FE WAN 8 FE LAN 256DDR (0235A0C4) H3C MSR 920 Router 2 FE WAN 8 FE LAN 256DDR (0235A0C0) MSR 93X (Comware 5) R2514P01 or later JG512A HP MSR930 Wireless Router JG513A HP MSR930 3G Router JG514A HP MSR931 Router JG515A HP MSR931 3G Router JG516A HP MSR933 Router JG517A HP MSR933 3G Router JG518A HP MSR935 Router JG519A HP MSR935 Wireless Router JG520A HP MSR935 3G Router JG531A HP MSR931 Dual 3G Router JG596A HP MSR930 4G LTE/3G CDMA Router JG597A HP MSR936 Wireless Router JG665A HP MSR930 4G LTE/3G WCDMA Global Router JG704A HP MSR930 4G LTE/3G WCDMA ATT Router N/A MSR1000 (Comware 5) R2514P01 or later JG732A HP MSR1003-8 AC Router N/A MSR20 RU (Comware 5 Low Encryption SW) R2514L03 or later JD663B HP MSR20-21 Router JF228A HP MSR20-40 Router JF283A HP MSR20-20 Router H3C RT-MSR2020-AC-OVS-H3C (0235A324) H3C RT-MSR2040-AC-OVS-H3 (0235A326) MSR20-1X RU (Comware 5 Low Encryption SW) R2514L03 or later JD431A HP MSR20-10 Router JF236A HP MSR20-15-I Router JF237A HP MSR20-15-A Router JF238A HP MSR20-15-I-W Router JF239A HP MSR20-11 Router JF240A HP MSR20-13 Router JF241A HP MSR20-12 Router JF806A HP MSR20-12-T Router JF807A HP MSR20-12-W Router JF808A HP MSR20-13-W Router JF809A HP MSR20-15-A-W Router JF817A HP MSR20-15 Router H3C MSR 20-10 (0235A0A7) H3C RT-MSR2015-AC-OVS-I-H3 (0235A394) H3C RT-MSR2015-AC-OVS-A-H3 (0235A392) H3C RT-MSR2015-AC-OVS-AW-H3 (0235A393) H3C RT-MSR2011-AC-OVS-H3 (0235A395) H3C RT-MSR2013-AC-OVS-H3 (0235A390) H3C RT-MSR2012-AC-OVS-H3 (0235A396) H3C RT-MSR2012-TAC-OVS-H3 (0235A398) H3C RT-MSR2012-AC-OVS-W-H3 (0235A397) H3C RT-MSR2013-AC-OVS-W-H3 (0235A391) H3C RT-MSR2015-AC-OVS-IW-H3 (0235A38V) H3C MSR 20-15 Router Host(AC) 1 FE 4 LSW 1 ADSLoPOTS 1 DSIC (0235A0A8) MSR30 RU (Comware 5 Low Encryption SW) R2514L03 or later JF229A HP MSR30-40 Router JF230A HP MSR30-60 Router JF235A HP MSR30-20 DC Router JF284A HP MSR30-20 Router JF287A HP MSR30-40 DC Router JF801A HP MSR30-60 DC Router JF802A HP MSR30-20 PoE Router JF803A HP MSR30-40 PoE Router JF804A HP MSR30-60 PoE Router H3C RT-MSR3040-AC-OVS-H (0235A299) H3C RT-MSR3060-AC-OVS-H3 (0235A320) H3C RT-MSR3020-DC-OVS-H3 (0235A267) H3C MSR 30-20 Router (0235A328) H3C MSR 30-40 Router Host(DC) (0235A268) H3C RT-MSR3060-DC-OVS-H3 (0235A269) H3C RT-MSR3020-AC-POE-OVS-H3 (0235A322) H3C RT-MSR3040-AC-POE-OVS-H3 (0235A323) H3C RT-MSR3060-AC-POE-OVS-H3 (0235A296) MSR30-16 RU (Comware 5 Low Encryption SW) R2514L03 or later JF233A HP MSR30-16 Router JF234A HP MSR30-16 PoE Router H3C RT-MSR3016-AC-OVS-H3 (0235A327) H3C RT-MSR3016-AC-POE-OVS-H3 (0235A321) MSR30-1X RU (Comware 5 Low Encryption SW) R2514L03 or later JF800A HP MSR30-11 Router JF816A HP MSR30-10 2 FE /2 SIC /1 MIM MS Rtr JG182A HP MSR30-11E Router JG183A HP MSR30-11F Router JG184A HP MSR30-10 DC Router H3C RT-MSR3011-AC-OVS-H3 (0235A29L) H3C MSR 30-10 Router Host(AC) 2FE 2SIC 1XMIM 256DDR (0235A39H) MSR50 RU(Comware 5 Low Encryption SW) R2514L03 or later JD433A HP MSR50-40 Router JD653A HP MSR50Processor Module JD655A HP MSR50-40 Multi-Service Router JD656A HP MSR50-60 Multi-Service Router JF231A HP MSR50-60 Router JF285A HP MSR50-40 DC Router JF640A HP MSR50-60 Rtr Chassis w DC PwrSupply H3C MSR 50-40 Router (0235A297) H3C MSR 50 Processor Module (0231A791) H3C MSR 50-40 Chassis (0235A20N) H3C MSR 50-60 Chassis (0235A20L) H3C RT-MSR5060-AC-OVS-H3 (0235A298) H3C MSR5040-DCOVS-H3C (0235A20P) MSR50 G2 RU (Comware 5 Low Encryption SW) R2514L03 or later JD429B HP MSR50 G2 Processor Module H3C MSR 50 High Performance Main Processing Unit 3GE (Combo) 256F/1GD (0231A0KL) 12500 (Comware 5) R1829 or later JC085A HP A12518 Switch Chassis JC086A HP A12508 Switch Chassis JC652A HP 12508 DC Switch Chassis JC653A HP 12518 DC Switch Chassis JC654A HP 12504 AC Switch Chassis JC655A HP 12504 DC Switch Chassis JF430A HP A12518 Switch Chassis JF430B HP 12518 Switch Chassis JF430C HP 12518 AC Switch Chassis JF431A HP A12508 Switch Chassis JF431B HP 12508 Switch Chassis JF431C HP 12508 AC Switch Chassis JC072B HP 12500 Main Processing Unit JC808A HP 12500 TAA Main Processing Unit H3C S12508 Routing Switch (AC-1) (0235A0GE) H3C S12518 Routing Switch (AC-1) (0235A0GF) H3C S12508 Chassis (0235A0E6) H3C S12508 Chassis (0235A38N) H3C S12518 Chassis (0235A0E7) H3C S12518 Chassis (0235A38M) H3C 12508 DC Switch Chassis (0235A38L) H3C 12518 DC Switch Chassis (0235A38K) 9500E (Comware 5) R1829 or later JC124A HP A9508 Switch Chassis JC124B HP 9505 Switch Chassis JC125A HP A9512 Switch Chassis JC125B HP 9512 Switch Chassis JC474A HP A9508-V Switch Chassis JC474B HP 9508-V Switch Chassis H3C S9505E Routing-Switch Chassis (0235A0G6) H3C S9512E Routing-Switch Chassis (0235A0G7) H3C S9508E-V Routing-Switch Chassis (0235A38Q) H3C S9505E Chassis w/ Fans (0235A38P) H3C S9512E Chassis w/ Fans (0235A38R) 12500 (Comware 7) R7375 or later JC085A HP A12518 Switch Chassis JC086A HP A12508 Switch Chassis JC652A HP 12508 DC Switch Chassis JC653A HP 12518 DC Switch Chassis JC654A HP 12504 AC Switch Chassis JC655A HP 12504 DC Switch Chassis JF430A HP A12518 Switch Chassis JF430B HP 12518 Switch Chassis JF430C HP 12518 AC Switch Chassis JF431A HP A12508 Switch Chassis JF431B HP 12508 Switch Chassis JF431C HP 12508 AC Switch Chassis JC072B HP 12500 Main Processing Unit JG497A HP 12500 MPU w/Comware V7 OS JG782A HP FF 12508E AC Switch Chassis JG783A HP FF 12508E DC Switch Chassis JG784A HP FF 12518E AC Switch Chassis JG785A HP FF 12518E DC Switch Chassis JG802A HP FF 12500E MPU JG836A HP FlexFabric 12518E AC Switch TAA-compliant Chassis JG834A HP FlexFabric 12508E AC Switch TAA-compliant Chassis JG835A HP FlexFabric 12508E DC Switch TAA-compliant Chassis JG837A HP FlexFabric 12518E DC Switch TAA-compliant Chassis JG803A HP FlexFabric 12500E TAA-compliant Main Processing Unit JG796A HP FlexFabric 12500 48-port 10GbE SFP+ FD Module JG790A HP FlexFabric 12500 16-port 40GbE QSFP+ FD Module JG794A HP FlexFabric 12500 40-port 10GbE SFP+ FG Module JG792A HP FlexFabric 12500 40-port 10GbE SFP+ FD Module JG788A HP FlexFabric 12500 4-port 100GbE CFP FG Module JG786A HP FlexFabric 12500 4-port 100GbE CFP FD Module JG797A HP FlexFabric 12500 48-port 10GbE SFP+ FD TAA-compliant Module JG791A HP FlexFabric 12500 16-port 40GbE QSFP+ FD TAA-compliant Module JG795A HP FlexFabric 12500 40-port 10GbE SFP+ FG TAA-compliant Module JG793A HP FlexFabric 12500 40-port 10GbE SFP+ FD TAA-compliant Module JG789A HP FlexFabric 12500 4-port 100GbE CFP FG TAA-compliant Module JG787A HP FlexFabric 12500 4-port 100GbE CFP FD TAA-compliant Module JG798A HP FlexFabric 12508E Fabric Module H3C S12508 Routing Switch (AC-1) (0235A0GE) H3C S12518 Routing Switch (AC-1) (0235A0GF) H3C S12508 Chassis (0235A0E6) H3C S12508 Chassis (0235A38N) H3C S12518 Chassis (0235A0E7) H3C S12518 Chassis (0235A38M) H3C 12508 DC Switch Chassis (0235A38L) H3C 12518 DC Switch Chassis (0235A38K) 10500 (Comware 7) R7168 or later JC611A HP 10508-V Switch Chassis JC612A HP 10508 Switch Chassis JC613A HP 10504 Switch Chassis JC748A HP 10512 Switch Chassis JG820A HP 10504 TAA Switch Chassis JG821A HP 10508 TAA Switch Chassis JG822A HP 10508-V TAA Switch Chassis JG823A HP 10512 TAA Switch Chassis JG496A HP 10500 Type A MPU w/Comware v7 OS JH198A HP 10500 Type D Main Processing Unit with Comware v7 Operating System JH191A HP 10500 44-port GbE(SFP,LC)/ 4-port 10GbE SFP+ (SFP+,LC) SE Module JH192A HP 10500 48-port Gig-T (RJ45) SE Module JH193A HP 10500 16-port 10GbE SFP+ (SFP+,LC) SF Module JH194A HP 10500 24-port 10GbE SFP+ (SFP+,LC) EC Module JH195A HP 10500 6-port 40GbE QSFP+ EC Module JH196A HP 10500 2-port 100GbE CFP EC Module JH197A HP 10500 48-port 10GbE SFP+ (SFP+,LC) SG Module N/A 5900 (Comware 7) R2422P01 or later JC772A HP 5900AF-48XG-4QSFP+ Switch JG336A HP 5900AF-48XGT-4QSFP+ Switch JG510A HP 5900AF-48G-4XG-2QSFP+ Switch JG554A HP 5900AF-48XG-4QSFP+ TAA Switch JG838A HP FF 5900CP-48XG-4QSFP+ Switch JH036A HP FlexFabric 5900CP 48XG 4QSFP+ TAA-Compliant JH037A HP 5900AF 48XGT 4QSFP+ TAA-Compliant Switch JH038A) HP 5900AF 48G 4XG 2QSFP+ TAA-Compliant N/A 5920 (Comware 7) R2422P01 or later JG296A HP 5920AF-24XG Switch JG555A HP 5920AF-24XG TAA Switch N/A MSR1000 (Comware 7) R0304P02 or later JG875A HP MSR1002-4 AC Router JH060A HP MSR1003-8S AC Router N/A MSR2000 (Comware 7) R0304P02 or later JG411A HP MSR2003 AC Router JG734A HP MSR2004-24 AC Router JG735A) HP MSR2004-48 Router JG866A HP MSR2003 TAA-compliant AC Router N/A MSR3000 (Comware 7) R0304P02 or later JG404A HP MSR3064 Router JG405A HP MSR3044 Router JG406A HP MSR3024 AC Router JG407A HP MSR3024 DC Router JG408A HP MSR3024 PoE Router JG409A HP MSR3012 AC Router JG410A HP MSR3012 DC Router JG861A HP MSR3024 TAA-compliant AC Router N/A MSR4000 (Comware 7) R0304P02 or later JG402A HP MSR4080 Router Chassis JG403A HP MSR4060 Router Chassis JG412A HP MSR4000 MPU-100 Main Processing Unit JG869A HP MSR4000 TAA-compliant MPU-100 Main Processing Unit N/A VSR (Comware 7) E0321 or later JG810AAE HP VSR1001 Virtual Services Router 60 Day Evaluation Software JG811AAE HP VSR1001 Comware 7 Virtual Services Router JG812AAE HP VSR1004 Comware 7 Virtual Services Router JG813AAE HP VSR1008 Comware 7 Virtual Services Router N/A 5930 (Comware 7) R2422P01 or later JG726A HP FlexFabric 5930 32QSFP+ Switch JG727A HP FlexFabric 5930 32QSFP+ TAA-compliant Switch JH178A HP FlexFabric 5930 2QSFP+ 2-slot Switch JH179A HP FlexFabric 5930 4-slot Switch JH187A HP FlexFabric 5930 2QSFP+ 2-slot TAA-compliant Switch JH188A HP FlexFabric 5930 4-slot TAA-compliant Switch N/A HSR6602 (Comware 7) R7103P05 or later JG353A HP HSR6602-G Router JG354A HP HSR6602-XG Router JG776A HP HSR6602-G TAA-compliant Router JG777A HP HSR6602-XG TAA-compliant Router N/A HSR6800 (Comware 7) R7103P05 pr later JG361A HP HSR6802 Router Chassis JG361B HP HSR6802 Router Chassis JG362A HP HSR6804 Router Chassis JG362B HP HSR6804 Router Chassis JG363A HP HSR6808 Router Chassis JG363B HP HSR6808 Router Chassis JG364A HP HSR6800 RSE-X2 Router Main Processing Unit JG779A HP HSR6800 RSE-X2 Router TAA-compliant Main Processing Unit JH075A) HP HSR6800 RSE-X3 Router Main Processing Unit N/A HISTORY Version:1 (rev.1) - 18 December 2015 Initial Release Version:2 (rev.2) - 12 January 2016 Changed name of fix R2422 to R2422P01 Version:3 (rev.3) - 29 January 2016 Added Note section in the Vulnerability Summary Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJWq9bRAAoJEGIGBBYqRO9/SZgH/jR3sYXQXaNXUT3barkmxeIz YfdrrBda6xUECJ4jASbbcPQRPB9v0rBdMG0xtX/y49TkTIBDPoqDygrY+imZQQ5n rMSeLBa3+ZlsgBE9PZ3stOOR261CgP3Iymp5NJvVeFYPV8XKhcS+Zne81SSoiLqp HpZIzQX90vZ0Oz4hXmdP2A/1yK8kjSFIe4eSTb8DdlqYtgPqqgIaY4UT8U56LrQG FU8Q6StuZH9eOIehTkmi9nTN4fn87+NR46d16yXRTL9MHAr2gpq8mr1DRX88mTNf /ZjYJHv1bES250S6jJZsf06BTKQwLeRg11EWpK4pYycV2emOsA11qVCZiblSSfc= =NEGF -----END PGP SIGNATURE-----

The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service (IPsec connection termination) via a crafted IKEv1 packet to a tunnel endpoint, aka Bug ID CSCuw08236. Vendors have confirmed this vulnerability Bug ID CSCuw08236 It is released as. Supplementary information : CWE Vulnerability type by CWE-19: Data Handling ( Data processing ) Has been identified. http://cwe.mitre.org/data/definitions/19.htmlExpertly crafted tunnel endpoint by third party IKEv1 Service disruption via packets (IPsec Disconnection ) There is a possibility of being put into a state. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. Successful exploits may allow attackers to cause the device to crash, denying service to legitimate users

Dell Pre-Boot Authentication Driver (PBADRV.sys) 1.0.1.5 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x0022201c IOCTL call. Attackers can exploit this issue to execute arbitrary code in the context of the affected application and gain elevated privileges. Dell Pre-Boot Authentication Driver 1.0.1.5 is vulnerable; other versions may also be affected. The title have been changed to better reflect the underlying component affected

The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, which makes it easier for remote attackers to obtain sensitive information or bypass authentication via a brute-force attack. Samsung SmartTV and Printers are prone to a security vulnerability that may allow attackers to obtain sensitive information. Attackers can exploit this issue with brute-force techniques to obtain passwords that can aid in further attacks. Samsung Smart TVs X10P, etc. are all smart TVs of South Korea's Samsung (Samsung) that integrate network content, Apps applications, AllShare content, search functions, and traditional TV channel lists into one user interface. Soft Access Point (AP) is one of the wireless access functions. There are security vulnerabilities in the Soft AP function of several Samsung products. The following products are affected: Samsung Smart TVs X10P, X12, X14H, X14J, NT14U, Xpress M288OFW. ================================================================ Samsung softap weak random generated password (This affects SmartTV and Printers) ================================================================ Information ********************** Vulnerability Type : Weak password Vulnerable Version : many Severity: Medium Author – Augusto Pereyra CVE-ID: CVE-2015-5729 (waiting) Twitter: @aedpereyra Description *********************** Samsung SoftAP WPA2-PSK weak password randomly generated. It’s possible intersept wpa2-psk handshake and crack the password using aircrack in a few hours Detailed description ************************** http://kaoticoneutral.blogspot.com.ar/2015/12/samsung-smarttv-and-printers-weak.html Severity Level: ========================================================= Medium Description: ========================================================== Vulnerable Product: [+] Samsung Smartvs with wifi included (Some of this firmware could be in process) Model Firmware patched X10P EU T-MST10PDEUCB-1210.0 X10P US T-MST10PAUSCB-1300.0 X10P US T-MST10PAUSCP-1302.0 X10P IBR T-MST10PIBRCB-1104.0 X12 EU T-MST12DEUCB-1111.4 X12 US T-MST12AKUCB-1114.0 X14H EU T-MST14DEUCB-1023.0 X14H US T-MST14AKUCB-1100.4 X14H CN T-MST14DCNCB-1010.0 X14J CN T-MS14JDCNCB-1004.2 X14J US T-MS14JAKUCB - 1102.5 X14J EU T-MS14JDEUCB-1018.0 NT14U EU T-NT14UDEUCB-1007.1 NT14U US T-NT14UAKUCB-1008.0 NT14U CN T-NT14UDCNCB-1003.1 [+] May be all printers Xpress series. Confirmed in M288OFW Vulnerable Parameter(s): [+] WPA2 password Advisory Timeline ************************ 20-Jul-2015- Reported 27-Jul-2015- Vendor Response 02-Dec-2015- Vendor Fixed some models 17-Dec-2015- Public disclosed Fixed Version: ***************** All version could be fixed if you read the workaround described in "Detailed Description" Reference ***************** https://samsungtvbounty.com/HallofFame.aspx http://kaoticoneutral.blogspot.com.ar/2015/12/samsung-smarttv-and-printers-weak.html

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data. Schneider Electric Modicon M340 PLC BMXNOx and BMXPx are programmable controller products from Schneider Electric, France. GoAhead Web Server is one of the embedded web servers. Schneider Electric Modicon M340 is prone to an unspecified stack-based buffer-overflow vulnerability. Failed exploit attempts may crash the application, denying service to legitimate users

Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%.". Supplementary information : CWE Vulnerability type by CWE-601: URL Redirection to Untrusted Site ( Open redirect ) Has been identified. http://cwe.mitre.org/data/definitions/601.htmlA third party " Clear text " Related to base64 Encoded with URL Any user through Web You may be redirected to a site and run a phishing attack. Both BlueCoatSystemsProxySG and AdvancedSecureGateway are secure Web gateway devices from BlueCoatSystems, USA. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible

Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. eWON is an industrial router product of the Belgian eWON company. eWON are prone to the following security vulnerabilities: 1. Weak session management vulnerability 2. Unauthorized Access Vulnerability 4. HTML-injection vulnerability 5. Plain text password information disclosure vulnerability 6. A security weakness An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. *eWON sa Industrial router - Multiple Vulnerabilities* eWON connects the machine across the Internet Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all types of technical data originating from industrial machines. Typical applications within the scope of our mission include remote maintenance, predictive maintenance, remote services, asset management, remote metering, multi-site building management, M2M, and more. *AFFECTED PRODUCTS* The following eWON router firmware versions are affected: *All eWON firmware versions prior to 10.1s0* *Reference* https://ics-cert.us-cert.gov/advisories/ICSA-15-342-01 *Vulnerabilities* *WEAK SESSION MANAGEMENT - FIXED by eWON* CVE-2015-7924 Session remains active even after user performs log off. Session is destroyed only after browser is exited. *CROSS-SITE REQUEST FORGERY ATTACKS - NOT FIXED by eWON* CVE-2015-7925 There is no CSRF token set by the application in any of the forms / pages. Any & all functions can be executed silently without getting validated from authorized user, if / when this issue is exploited. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON says*Verified but won't fix. The current implementation is done by design (the user must be able to submit forms using GET only). As CSRF attack suggests, the user must be already logged on the eWON using its internet browser and the session must thus be valid on user's browser. However eWON IP must also be known by the attacker knowing that the VPN will set another IP each time the victim connects to eWON. The connection to an eWON device is only possible by a secured VPN, a point- to-point LAN or a secured LAN. On their website, eWON describes this issue as following: http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01 Mitigating factors: Many requirements have to be met for a successful attack: The attacker needs a valid login to the eWON. The attacker needs HTTP access to the eWON (e.g. eWON web server exposed to the public Internet). Also connections to eWON devices should in standard use cases only occur through: - a point-to-point LAN, a secured LAN (sniffing the victim IP is not really achievable in these two cases) - or a secured VPN (VPN allocated IP address is then defined by the VPN server). —> eWON team just doesn't understand how CSRF works. And continue to assume the device mgmt portal is accessible ONLY over the VPN, P2P LAN or secured LAN. They clearly have not looked at Shodan and / or publicly accessible portals. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *WEAK RBAC CONTROLS - FIXED by eWON* CVE-2015-7926 The software allows an unauthenticated user to gather information and status of I/O servers through the use of a forged URL. *NOTE*: It should be - *An unauthorized / low-privileged user can perform several unauthorized actions such as reading, updating, & deleting I/O servers, configurations, enabling/disabling I/O servers, & accessing, deleting valid users.* *Scenario* Two users 1. adm - Default privileged user - can perform all administrative functions - full rights - [ v o a c f e h j ] 2. test - newly created user - no rights - no [ v o a c f e h j ] *Issue 1* *It is possible to enumerate valid I/O servers* I/O Server list is a set defined list: MEM cbIOSrvList=0 EWON cbIOSrvList=1 MODBUS cbIOSrvList=2 NETMPI ... SNMP cbIOSrvList=4 DF1 ... FINS ... so on ... & others An unauthorized / unprivileged user can gather information and status of these IO servers in the following manner: *Logged in as ‘test'* Access - http://<IP>/rcgi.bin/Edit1IOSrvForm?cbIOSrvList=0&Ac2on=edit If Response says -> Not Configurable. -> Implies Not a valid I/O If Response says -> Access Denied -> Implies a valid I/O -> Window Title reveals the I/O server type - example, Modbus IO Server Config, DF1 1O Server Config, n so on *Issue 2* *It is possible to modify parameter values of I/O servers directly*Updating the values when logged in as 'test' Change POST request to GET Modify param values http://<IP>/rcgi.bin/EditUsrIOSrvForm?edCfgData=MinInterval%3A10%0D %0AMaxInterval%3A268435459%0D%0AReverseCount %3A0&B1=Update&AST_IOSrvNdx=1 Response -> IO Server config updated. Similarly, other I/O server configuration can be updated. In case an I/O server is not Enabled, it can be enabled and configured with custom values. *Following poc for SNMP I/O Server settings (This IO server communicates with any SNMP device)* Enabling and configuring SNMP I/O server (logged in as test) http://<IP>/rcgi.bin/EditAdvUsrIOSrvForm? edEnabledA=1&edGlobAddrA=&edPeriodA=&edGlobAddrB=&edPeriodB=&edGlo bAddrC=&edPeriodC=&B1=Update+Config&IOServer=SNMP -> IO Server config updated. *Issue 3* *Deleting All Users* It is possible for a user with no rights to: 1. Enumerate configured users 2. Delete any & all users. HTTP GET request to delete a user (when logged in as 'test') (unauthorized request) http://<IP>/rcgi.bin/EditForm?CB2=3&NbCB=4&Opera2onType=DeleteUser This brings up a confirmation prompt validating if we really want to delete the user. It presents the username and offers two options - Option 1 - Cancel and Confirm/Delete Option 2 - Select Confirm/Delete ..... Users List test Please confirm you want to delete these items Select Confirm/Delete ..... Next, the url redirects to DeleteForm which then shows Access denied twice ..... -> But the user gets deleted anyway. :) Verify by Refreshing User List *Enumerating Users* In order to enumerate valid users, we only need to submit the first DeleteUser request http://<IP>/rcgi.bin/EditForm?CB2=4&NbCB=3&Opera2onType=DeleteUser It will show the username. This process can of course be automated to view all valid application usernames. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON considered WEAK RBAC issue a minor one. Apparently, they didn’t understood the impact at all.* eWON said: It's a minor issue as these informations are already available through eWON User Manual. We will however completely block the page in a future eWON firmware release when user credentials don't meet the requirements to avoid any ambiguity regarding eWON security. —> Regardless, the new firmware says this issue has been fixed.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *STORED CROSS-SITE SCRIPTING - NOT FIXED by eWON* CVE-2015-7927 *Vulnerable functions / parameters* Create / Edit User User First Name User Last Name User information Create / Edit Tag Tag Description …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Verified. Won't fix: We left the possibility to include HTML tags or javascript in form fields and form url parameters to meet some specific final user needs. Note that this kind of injection is achievable through FTP upload as everything is saved in the eWON config files. Furthermore all theses XSS exploit also require valid user authentication and rights. —> Yeah, it’s a feature and input validation is a useless practice anyway.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *Reflected XSS - NOT FIXED by eWON* Vulnerable parameter - AST_ErrorMsg http://<IP>/rcgi.bin/wsdForm?sys_Csave=1&AST_ErrorMsg=Success<script>alert("xss-AST_ErrorMsg")</ script>&sys_IpMbsSrvPort=502&sys_IpEipSrvPort=44818&sys_IpIsoSrvPort=102& sys_IpFinsSrvPort=9600&sys_TagPollMode=0&sys_IOTcpDefTO=1000&btUpdate= Update *PASSWORDS NOT SECURED - PARTIAL FIX by eWON* CVE-2015-7928 Passwords are passed in plain text allowing a malicious party to retrieve them from network traffic. The autocomplete setting of some eWON forms also allows these passwords to be retrieved from the browser. Compromise of the credentials would allow unauthenticated access. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says 2. Won't fix as the final user is supposed to configure eWON through VPN. —> Yeah, *supposed to*.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *POST/GET ISSUES - NOT FIXED by eWON* CVE-2015-7929 eWON firmware web server allows the use of the HTML command GET in place of POST. GET is less secure because data that are sent are part of the URL. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Won't fix. This could be a problem regarding CRSF (issue B) but the final user is supposed to configure eWON through VPN (and thus https). Mitigating factors: This could be an issue regarding the CSRF attacks described above. However as already mentioned the eWON firmware exposure to CSRF attacks is really limited. Thus having equivalent POST and GET parameters handling for each request sent to the eWON webserver is by extension not problematic. —> Yeah, *supposed to*.. Not problematic... …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. -- Best Regards, Karn Ganeshen

eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. eWON is an industrial router product of the Belgian eWON company. A security vulnerability exists in eWON using firmware prior to 10.1s0, which is caused by the program transmitting passwords in clear text. An attacker could exploit the vulnerability to obtain plain text passwords and unauthorized access rights. eWON are prone to the following security vulnerabilities: 1. Weak session management vulnerability 2. A cross-site request forgery vulnerability 3. HTML-injection vulnerability 5. A security weakness An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. The vulnerability stems from the fact that the program does not set the auto-complete property for the password field. *eWON sa Industrial router - Multiple Vulnerabilities* eWON connects the machine across the Internet Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all types of technical data originating from industrial machines. Typical applications within the scope of our mission include remote maintenance, predictive maintenance, remote services, asset management, remote metering, multi-site building management, M2M, and more. *AFFECTED PRODUCTS* The following eWON router firmware versions are affected: *All eWON firmware versions prior to 10.1s0* *Reference* https://ics-cert.us-cert.gov/advisories/ICSA-15-342-01 *Vulnerabilities* *WEAK SESSION MANAGEMENT - FIXED by eWON* CVE-2015-7924 Session remains active even after user performs log off. Session is destroyed only after browser is exited. *CROSS-SITE REQUEST FORGERY ATTACKS - NOT FIXED by eWON* CVE-2015-7925 There is no CSRF token set by the application in any of the forms / pages. Any & all functions can be executed silently without getting validated from authorized user, if / when this issue is exploited. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON says*Verified but won't fix. The current implementation is done by design (the user must be able to submit forms using GET only). As CSRF attack suggests, the user must be already logged on the eWON using its internet browser and the session must thus be valid on user's browser. However eWON IP must also be known by the attacker knowing that the VPN will set another IP each time the victim connects to eWON. The connection to an eWON device is only possible by a secured VPN, a point- to-point LAN or a secured LAN. On their website, eWON describes this issue as following: http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01 Mitigating factors: Many requirements have to be met for a successful attack: The attacker needs a valid login to the eWON. The attacker needs HTTP access to the eWON (e.g. eWON web server exposed to the public Internet). Also connections to eWON devices should in standard use cases only occur through: - a point-to-point LAN, a secured LAN (sniffing the victim IP is not really achievable in these two cases) - or a secured VPN (VPN allocated IP address is then defined by the VPN server). —> eWON team just doesn't understand how CSRF works. And continue to assume the device mgmt portal is accessible ONLY over the VPN, P2P LAN or secured LAN. They clearly have not looked at Shodan and / or publicly accessible portals. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *WEAK RBAC CONTROLS - FIXED by eWON* CVE-2015-7926 The software allows an unauthenticated user to gather information and status of I/O servers through the use of a forged URL. *NOTE*: It should be - *An unauthorized / low-privileged user can perform several unauthorized actions such as reading, updating, & deleting I/O servers, configurations, enabling/disabling I/O servers, & accessing, deleting valid users.* *Scenario* Two users 1. adm - Default privileged user - can perform all administrative functions - full rights - [ v o a c f e h j ] 2. test - newly created user - no rights - no [ v o a c f e h j ] *Issue 1* *It is possible to enumerate valid I/O servers* I/O Server list is a set defined list: MEM cbIOSrvList=0 EWON cbIOSrvList=1 MODBUS cbIOSrvList=2 NETMPI ... SNMP cbIOSrvList=4 DF1 ... FINS ... so on ... & others An unauthorized / unprivileged user can gather information and status of these IO servers in the following manner: *Logged in as ‘test'* Access - http://<IP>/rcgi.bin/Edit1IOSrvForm?cbIOSrvList=0&Ac2on=edit If Response says -> Not Configurable. -> Implies Not a valid I/O If Response says -> Access Denied -> Implies a valid I/O -> Window Title reveals the I/O server type - example, Modbus IO Server Config, DF1 1O Server Config, n so on *Issue 2* *It is possible to modify parameter values of I/O servers directly*Updating the values when logged in as 'test' Change POST request to GET Modify param values http://<IP>/rcgi.bin/EditUsrIOSrvForm?edCfgData=MinInterval%3A10%0D %0AMaxInterval%3A268435459%0D%0AReverseCount %3A0&B1=Update&AST_IOSrvNdx=1 Response -> IO Server config updated. Similarly, other I/O server configuration can be updated. In case an I/O server is not Enabled, it can be enabled and configured with custom values. *Following poc for SNMP I/O Server settings (This IO server communicates with any SNMP device)* Enabling and configuring SNMP I/O server (logged in as test) http://<IP>/rcgi.bin/EditAdvUsrIOSrvForm? edEnabledA=1&edGlobAddrA=&edPeriodA=&edGlobAddrB=&edPeriodB=&edGlo bAddrC=&edPeriodC=&B1=Update+Config&IOServer=SNMP -> IO Server config updated. *Issue 3* *Deleting All Users* It is possible for a user with no rights to: 1. Enumerate configured users 2. Delete any & all users. HTTP GET request to delete a user (when logged in as 'test') (unauthorized request) http://<IP>/rcgi.bin/EditForm?CB2=3&NbCB=4&Opera2onType=DeleteUser This brings up a confirmation prompt validating if we really want to delete the user. It presents the username and offers two options - Option 1 - Cancel and Confirm/Delete Option 2 - Select Confirm/Delete ..... Users List test Please confirm you want to delete these items Select Confirm/Delete ..... Next, the url redirects to DeleteForm which then shows Access denied twice ..... -> But the user gets deleted anyway. :) Verify by Refreshing User List *Enumerating Users* In order to enumerate valid users, we only need to submit the first DeleteUser request http://<IP>/rcgi.bin/EditForm?CB2=4&NbCB=3&Opera2onType=DeleteUser It will show the username. This process can of course be automated to view all valid application usernames. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON considered WEAK RBAC issue a minor one. Apparently, they didn’t understood the impact at all.* eWON said: It's a minor issue as these informations are already available through eWON User Manual. We will however completely block the page in a future eWON firmware release when user credentials don't meet the requirements to avoid any ambiguity regarding eWON security. —> Regardless, the new firmware says this issue has been fixed.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *STORED CROSS-SITE SCRIPTING - NOT FIXED by eWON* CVE-2015-7927 *Vulnerable functions / parameters* Create / Edit User User First Name User Last Name User information Create / Edit Tag Tag Description …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Verified. Won't fix: We left the possibility to include HTML tags or javascript in form fields and form url parameters to meet some specific final user needs. Note that this kind of injection is achievable through FTP upload as everything is saved in the eWON config files. Furthermore all theses XSS exploit also require valid user authentication and rights. —> Yeah, it’s a feature and input validation is a useless practice anyway.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *Reflected XSS - NOT FIXED by eWON* Vulnerable parameter - AST_ErrorMsg http://<IP>/rcgi.bin/wsdForm?sys_Csave=1&AST_ErrorMsg=Success<script>alert("xss-AST_ErrorMsg")</ script>&sys_IpMbsSrvPort=502&sys_IpEipSrvPort=44818&sys_IpIsoSrvPort=102& sys_IpFinsSrvPort=9600&sys_TagPollMode=0&sys_IOTcpDefTO=1000&btUpdate= Update *PASSWORDS NOT SECURED - PARTIAL FIX by eWON* CVE-2015-7928 Passwords are passed in plain text allowing a malicious party to retrieve them from network traffic. The autocomplete setting of some eWON forms also allows these passwords to be retrieved from the browser. Compromise of the credentials would allow unauthenticated access. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says 2. Won't fix as the final user is supposed to configure eWON through VPN. —> Yeah, *supposed to*.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *POST/GET ISSUES - NOT FIXED by eWON* CVE-2015-7929 eWON firmware web server allows the use of the HTML command GET in place of POST. GET is less secure because data that are sent are part of the URL. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Won't fix. This could be a problem regarding CRSF (issue B) but the final user is supposed to configure eWON through VPN (and thus https). Mitigating factors: This could be an issue regarding the CSRF attacks described above. However as already mentioned the eWON firmware exposure to CSRF attacks is really limited. Thus having equivalent POST and GET parameters handling for each request sent to the eWON webserver is by extension not problematic. —> Yeah, *supposed to*.. Not problematic... …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. -- Best Regards, Karn Ganeshen

eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. eWON is an industrial router product of the Belgian eWON company. A security vulnerability exists in eWON using firmware prior to 10.1s0, which was caused by the program using an unsafe GET HTML command instead of a POST command. An attacker could exploit the vulnerability to perform unauthorized actions. eWON are prone to the following security vulnerabilities: 1. Weak session management vulnerability 2. A cross-site request forgery vulnerability 3. HTML-injection vulnerability 5. Plain text password information disclosure vulnerability 6. A security weakness An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. *eWON sa Industrial router - Multiple Vulnerabilities* eWON connects the machine across the Internet Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all types of technical data originating from industrial machines. Typical applications within the scope of our mission include remote maintenance, predictive maintenance, remote services, asset management, remote metering, multi-site building management, M2M, and more. *AFFECTED PRODUCTS* The following eWON router firmware versions are affected: *All eWON firmware versions prior to 10.1s0* *Reference* https://ics-cert.us-cert.gov/advisories/ICSA-15-342-01 *Vulnerabilities* *WEAK SESSION MANAGEMENT - FIXED by eWON* CVE-2015-7924 Session remains active even after user performs log off. Session is destroyed only after browser is exited. *CROSS-SITE REQUEST FORGERY ATTACKS - NOT FIXED by eWON* CVE-2015-7925 There is no CSRF token set by the application in any of the forms / pages. Any & all functions can be executed silently without getting validated from authorized user, if / when this issue is exploited. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON says*Verified but won't fix. The current implementation is done by design (the user must be able to submit forms using GET only). As CSRF attack suggests, the user must be already logged on the eWON using its internet browser and the session must thus be valid on user's browser. However eWON IP must also be known by the attacker knowing that the VPN will set another IP each time the victim connects to eWON. The connection to an eWON device is only possible by a secured VPN, a point- to-point LAN or a secured LAN. On their website, eWON describes this issue as following: http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01 Mitigating factors: Many requirements have to be met for a successful attack: The attacker needs a valid login to the eWON. The attacker needs HTTP access to the eWON (e.g. eWON web server exposed to the public Internet). Also connections to eWON devices should in standard use cases only occur through: - a point-to-point LAN, a secured LAN (sniffing the victim IP is not really achievable in these two cases) - or a secured VPN (VPN allocated IP address is then defined by the VPN server). —> eWON team just doesn't understand how CSRF works. And continue to assume the device mgmt portal is accessible ONLY over the VPN, P2P LAN or secured LAN. They clearly have not looked at Shodan and / or publicly accessible portals. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *WEAK RBAC CONTROLS - FIXED by eWON* CVE-2015-7926 The software allows an unauthenticated user to gather information and status of I/O servers through the use of a forged URL. *NOTE*: It should be - *An unauthorized / low-privileged user can perform several unauthorized actions such as reading, updating, & deleting I/O servers, configurations, enabling/disabling I/O servers, & accessing, deleting valid users.* *Scenario* Two users 1. adm - Default privileged user - can perform all administrative functions - full rights - [ v o a c f e h j ] 2. test - newly created user - no rights - no [ v o a c f e h j ] *Issue 1* *It is possible to enumerate valid I/O servers* I/O Server list is a set defined list: MEM cbIOSrvList=0 EWON cbIOSrvList=1 MODBUS cbIOSrvList=2 NETMPI ... SNMP cbIOSrvList=4 DF1 ... FINS ... so on ... & others An unauthorized / unprivileged user can gather information and status of these IO servers in the following manner: *Logged in as ‘test'* Access - http://<IP>/rcgi.bin/Edit1IOSrvForm?cbIOSrvList=0&Ac2on=edit If Response says -> Not Configurable. -> Implies Not a valid I/O If Response says -> Access Denied -> Implies a valid I/O -> Window Title reveals the I/O server type - example, Modbus IO Server Config, DF1 1O Server Config, n so on *Issue 2* *It is possible to modify parameter values of I/O servers directly*Updating the values when logged in as 'test' Change POST request to GET Modify param values http://<IP>/rcgi.bin/EditUsrIOSrvForm?edCfgData=MinInterval%3A10%0D %0AMaxInterval%3A268435459%0D%0AReverseCount %3A0&B1=Update&AST_IOSrvNdx=1 Response -> IO Server config updated. Similarly, other I/O server configuration can be updated. In case an I/O server is not Enabled, it can be enabled and configured with custom values. *Following poc for SNMP I/O Server settings (This IO server communicates with any SNMP device)* Enabling and configuring SNMP I/O server (logged in as test) http://<IP>/rcgi.bin/EditAdvUsrIOSrvForm? edEnabledA=1&edGlobAddrA=&edPeriodA=&edGlobAddrB=&edPeriodB=&edGlo bAddrC=&edPeriodC=&B1=Update+Config&IOServer=SNMP -> IO Server config updated. *Issue 3* *Deleting All Users* It is possible for a user with no rights to: 1. Enumerate configured users 2. Delete any & all users. HTTP GET request to delete a user (when logged in as 'test') (unauthorized request) http://<IP>/rcgi.bin/EditForm?CB2=3&NbCB=4&Opera2onType=DeleteUser This brings up a confirmation prompt validating if we really want to delete the user. It presents the username and offers two options - Option 1 - Cancel and Confirm/Delete Option 2 - Select Confirm/Delete ..... Users List test Please confirm you want to delete these items Select Confirm/Delete ..... Next, the url redirects to DeleteForm which then shows Access denied twice ..... -> But the user gets deleted anyway. :) Verify by Refreshing User List *Enumerating Users* In order to enumerate valid users, we only need to submit the first DeleteUser request http://<IP>/rcgi.bin/EditForm?CB2=4&NbCB=3&Opera2onType=DeleteUser It will show the username. This process can of course be automated to view all valid application usernames. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON considered WEAK RBAC issue a minor one. Apparently, they didn’t understood the impact at all.* eWON said: It's a minor issue as these informations are already available through eWON User Manual. We will however completely block the page in a future eWON firmware release when user credentials don't meet the requirements to avoid any ambiguity regarding eWON security. —> Regardless, the new firmware says this issue has been fixed.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *STORED CROSS-SITE SCRIPTING - NOT FIXED by eWON* CVE-2015-7927 *Vulnerable functions / parameters* Create / Edit User User First Name User Last Name User information Create / Edit Tag Tag Description …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Verified. Won't fix: We left the possibility to include HTML tags or javascript in form fields and form url parameters to meet some specific final user needs. Note that this kind of injection is achievable through FTP upload as everything is saved in the eWON config files. Furthermore all theses XSS exploit also require valid user authentication and rights. —> Yeah, it’s a feature and input validation is a useless practice anyway.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *Reflected XSS - NOT FIXED by eWON* Vulnerable parameter - AST_ErrorMsg http://<IP>/rcgi.bin/wsdForm?sys_Csave=1&AST_ErrorMsg=Success<script>alert("xss-AST_ErrorMsg")</ script>&sys_IpMbsSrvPort=502&sys_IpEipSrvPort=44818&sys_IpIsoSrvPort=102& sys_IpFinsSrvPort=9600&sys_TagPollMode=0&sys_IOTcpDefTO=1000&btUpdate= Update *PASSWORDS NOT SECURED - PARTIAL FIX by eWON* CVE-2015-7928 Passwords are passed in plain text allowing a malicious party to retrieve them from network traffic. The autocomplete setting of some eWON forms also allows these passwords to be retrieved from the browser. Compromise of the credentials would allow unauthenticated access. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says 2. Won't fix as the final user is supposed to configure eWON through VPN. —> Yeah, *supposed to*.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. GET is less secure because data that are sent are part of the URL. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Won't fix. This could be a problem regarding CRSF (issue B) but the final user is supposed to configure eWON through VPN (and thus https). Mitigating factors: This could be an issue regarding the CSRF attacks described above. However as already mentioned the eWON firmware exposure to CSRF attacks is really limited. Thus having equivalent POST and GET parameters handling for each request sent to the eWON webserver is by extension not problematic. —> Yeah, *supposed to*.. Not problematic... …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. -- Best Regards, Karn Ganeshen

Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors. An attacker can exploit these vulnerabilities to obtain potentially sensitive information, execute arbitrary script code in the context of the web server process and to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks

Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password. Motorola Solutions MOSCAD SCADA IP Gateway is a set of Web-based management system-based SCADA systems from Motorola Solutions. An attacker can exploit these vulnerabilities to obtain potentially sensitive information, execute arbitrary script code in the context of the web server process and to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. A remote attacker can exploit this vulnerability to change the password

Cisco FireSIGHT Management Center allows remote attackers to bypass the HTTP attack detection feature and avoid triggering Snort IDS rules via an SSL session that is mishandled after decryption, aka Bug ID CSCux53437. Vendors have confirmed this vulnerability Bug ID CSCux53437 It is released as. Supplementary information : CWE Vulnerability type by CWE-254: Security Features ( Security function ) Has been identified. The Cisco FireSIGHT Management Center is a suite of management software from Cisco, Inc. that supports centralized management of network security and operational features of Cisco ASA and Cisco FirePOWER network security appliances using FirePOWER Services. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks

Cisco DPQ3925 devices with EDVA r1 Base allow remote attackers to obtain sensitive information via a crafted HTTP request, aka Bug ID CSCuv03958. Cisco Model DPQ3925 with EDVA Devices have vulnerabilities that can capture important information. The Cisco DPQ3925 devices are a wireless router device from Cisco. This issue is tracked by Cisco Bug ID CSCuv03958

eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. Supplementary information : CWE Vulnerability type by CWE-613: Insufficient Session Expiration ( Incorrect session deadline ) Has been identified. https://cwe.mitre.org/data/definitions/613.htmlA third party may gain access by using an unattended workstation. eWON is an industrial router product of the Belgian eWON company. An attacker could exploit the vulnerability to interact with the device using the same session. eWON are prone to the following security vulnerabilities: 1. A cross-site request forgery vulnerability 3. Unauthorized Access Vulnerability 4. HTML-injection vulnerability 5. Plain text password information disclosure vulnerability 6. A security weakness An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. There is a security vulnerability in eWON using firmware 10.0s0 and earlier versions

Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot. eWON is an industrial router product of the Belgian eWON company. An attacker could exploit the vulnerability to perform unauthorized actions with user rights. eWON are prone to the following security vulnerabilities: 1. Weak session management vulnerability 2. Unauthorized Access Vulnerability 4. HTML-injection vulnerability 5. Plain text password information disclosure vulnerability 6. A security weakness An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. *eWON sa Industrial router - Multiple Vulnerabilities* eWON connects the machine across the Internet Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all types of technical data originating from industrial machines. Typical applications within the scope of our mission include remote maintenance, predictive maintenance, remote services, asset management, remote metering, multi-site building management, M2M, and more. *AFFECTED PRODUCTS* The following eWON router firmware versions are affected: *All eWON firmware versions prior to 10.1s0* *Reference* https://ics-cert.us-cert.gov/advisories/ICSA-15-342-01 *Vulnerabilities* *WEAK SESSION MANAGEMENT - FIXED by eWON* CVE-2015-7924 Session remains active even after user performs log off. Session is destroyed only after browser is exited. Any & all functions can be executed silently without getting validated from authorized user, if / when this issue is exploited. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON says*Verified but won't fix. The current implementation is done by design (the user must be able to submit forms using GET only). As CSRF attack suggests, the user must be already logged on the eWON using its internet browser and the session must thus be valid on user's browser. However eWON IP must also be known by the attacker knowing that the VPN will set another IP each time the victim connects to eWON. The connection to an eWON device is only possible by a secured VPN, a point- to-point LAN or a secured LAN. On their website, eWON describes this issue as following: http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01 Mitigating factors: Many requirements have to be met for a successful attack: The attacker needs a valid login to the eWON. The attacker needs HTTP access to the eWON (e.g. eWON web server exposed to the public Internet). Also connections to eWON devices should in standard use cases only occur through: - a point-to-point LAN, a secured LAN (sniffing the victim IP is not really achievable in these two cases) - or a secured VPN (VPN allocated IP address is then defined by the VPN server). —> eWON team just doesn't understand how CSRF works. And continue to assume the device mgmt portal is accessible ONLY over the VPN, P2P LAN or secured LAN. They clearly have not looked at Shodan and / or publicly accessible portals. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *WEAK RBAC CONTROLS - FIXED by eWON* CVE-2015-7926 The software allows an unauthenticated user to gather information and status of I/O servers through the use of a forged URL. *NOTE*: It should be - *An unauthorized / low-privileged user can perform several unauthorized actions such as reading, updating, & deleting I/O servers, configurations, enabling/disabling I/O servers, & accessing, deleting valid users.* *Scenario* Two users 1. adm - Default privileged user - can perform all administrative functions - full rights - [ v o a c f e h j ] 2. test - newly created user - no rights - no [ v o a c f e h j ] *Issue 1* *It is possible to enumerate valid I/O servers* I/O Server list is a set defined list: MEM cbIOSrvList=0 EWON cbIOSrvList=1 MODBUS cbIOSrvList=2 NETMPI ... SNMP cbIOSrvList=4 DF1 ... FINS ... so on ... & others An unauthorized / unprivileged user can gather information and status of these IO servers in the following manner: *Logged in as ‘test'* Access - http://<IP>/rcgi.bin/Edit1IOSrvForm?cbIOSrvList=0&Ac2on=edit If Response says -> Not Configurable. -> Implies Not a valid I/O If Response says -> Access Denied -> Implies a valid I/O -> Window Title reveals the I/O server type - example, Modbus IO Server Config, DF1 1O Server Config, n so on *Issue 2* *It is possible to modify parameter values of I/O servers directly*Updating the values when logged in as 'test' Change POST request to GET Modify param values http://<IP>/rcgi.bin/EditUsrIOSrvForm?edCfgData=MinInterval%3A10%0D %0AMaxInterval%3A268435459%0D%0AReverseCount %3A0&B1=Update&AST_IOSrvNdx=1 Response -> IO Server config updated. Similarly, other I/O server configuration can be updated. In case an I/O server is not Enabled, it can be enabled and configured with custom values. *Following poc for SNMP I/O Server settings (This IO server communicates with any SNMP device)* Enabling and configuring SNMP I/O server (logged in as test) http://<IP>/rcgi.bin/EditAdvUsrIOSrvForm? edEnabledA=1&edGlobAddrA=&edPeriodA=&edGlobAddrB=&edPeriodB=&edGlo bAddrC=&edPeriodC=&B1=Update+Config&IOServer=SNMP -> IO Server config updated. *Issue 3* *Deleting All Users* It is possible for a user with no rights to: 1. Enumerate configured users 2. Delete any & all users. HTTP GET request to delete a user (when logged in as 'test') (unauthorized request) http://<IP>/rcgi.bin/EditForm?CB2=3&NbCB=4&Opera2onType=DeleteUser This brings up a confirmation prompt validating if we really want to delete the user. It presents the username and offers two options - Option 1 - Cancel and Confirm/Delete Option 2 - Select Confirm/Delete ..... Users List test Please confirm you want to delete these items Select Confirm/Delete ..... Next, the url redirects to DeleteForm which then shows Access denied twice ..... -> But the user gets deleted anyway. :) Verify by Refreshing User List *Enumerating Users* In order to enumerate valid users, we only need to submit the first DeleteUser request http://<IP>/rcgi.bin/EditForm?CB2=4&NbCB=3&Opera2onType=DeleteUser It will show the username. This process can of course be automated to view all valid application usernames. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON considered WEAK RBAC issue a minor one. Apparently, they didn’t understood the impact at all.* eWON said: It's a minor issue as these informations are already available through eWON User Manual. We will however completely block the page in a future eWON firmware release when user credentials don't meet the requirements to avoid any ambiguity regarding eWON security. —> Regardless, the new firmware says this issue has been fixed.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *STORED CROSS-SITE SCRIPTING - NOT FIXED by eWON* CVE-2015-7927 *Vulnerable functions / parameters* Create / Edit User User First Name User Last Name User information Create / Edit Tag Tag Description …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Verified. Won't fix: We left the possibility to include HTML tags or javascript in form fields and form url parameters to meet some specific final user needs. Note that this kind of injection is achievable through FTP upload as everything is saved in the eWON config files. —> Yeah, it’s a feature and input validation is a useless practice anyway.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *Reflected XSS - NOT FIXED by eWON* Vulnerable parameter - AST_ErrorMsg http://<IP>/rcgi.bin/wsdForm?sys_Csave=1&AST_ErrorMsg=Success<script>alert("xss-AST_ErrorMsg")</ script>&sys_IpMbsSrvPort=502&sys_IpEipSrvPort=44818&sys_IpIsoSrvPort=102& sys_IpFinsSrvPort=9600&sys_TagPollMode=0&sys_IOTcpDefTO=1000&btUpdate= Update *PASSWORDS NOT SECURED - PARTIAL FIX by eWON* CVE-2015-7928 Passwords are passed in plain text allowing a malicious party to retrieve them from network traffic. The autocomplete setting of some eWON forms also allows these passwords to be retrieved from the browser. Compromise of the credentials would allow unauthenticated access. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says 2. Won't fix as the final user is supposed to configure eWON through VPN. —> Yeah, *supposed to*.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *POST/GET ISSUES - NOT FIXED by eWON* CVE-2015-7929 eWON firmware web server allows the use of the HTML command GET in place of POST. GET is less secure because data that are sent are part of the URL. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Won't fix. This could be a problem regarding CRSF (issue B) but the final user is supposed to configure eWON through VPN (and thus https). Mitigating factors: This could be an issue regarding the CSRF attacks described above. However as already mentioned the eWON firmware exposure to CSRF attacks is really limited. Thus having equivalent POST and GET parameters handling for each request sent to the eWON webserver is by extension not problematic. —> Yeah, *supposed to*.. Not problematic... …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. -- Best Regards, Karn Ganeshen

eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL. eWON is an industrial router product of the Belgian eWON company. A security vulnerability exists in eWON using firmware prior to 10.1s0. Weak session management vulnerability 2. A cross-site request forgery vulnerability 3. Unauthorized Access Vulnerability 4. HTML-injection vulnerability 5. Plain text password information disclosure vulnerability 6. A security weakness An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. *eWON sa Industrial router - Multiple Vulnerabilities* eWON connects the machine across the Internet Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all types of technical data originating from industrial machines. Typical applications within the scope of our mission include remote maintenance, predictive maintenance, remote services, asset management, remote metering, multi-site building management, M2M, and more. *AFFECTED PRODUCTS* The following eWON router firmware versions are affected: *All eWON firmware versions prior to 10.1s0* *Reference* https://ics-cert.us-cert.gov/advisories/ICSA-15-342-01 *Vulnerabilities* *WEAK SESSION MANAGEMENT - FIXED by eWON* CVE-2015-7924 Session remains active even after user performs log off. Session is destroyed only after browser is exited. *CROSS-SITE REQUEST FORGERY ATTACKS - NOT FIXED by eWON* CVE-2015-7925 There is no CSRF token set by the application in any of the forms / pages. Any & all functions can be executed silently without getting validated from authorized user, if / when this issue is exploited. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON says*Verified but won't fix. The current implementation is done by design (the user must be able to submit forms using GET only). As CSRF attack suggests, the user must be already logged on the eWON using its internet browser and the session must thus be valid on user's browser. However eWON IP must also be known by the attacker knowing that the VPN will set another IP each time the victim connects to eWON. The connection to an eWON device is only possible by a secured VPN, a point- to-point LAN or a secured LAN. On their website, eWON describes this issue as following: http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01 Mitigating factors: Many requirements have to be met for a successful attack: The attacker needs a valid login to the eWON. The attacker needs HTTP access to the eWON (e.g. eWON web server exposed to the public Internet). Also connections to eWON devices should in standard use cases only occur through: - a point-to-point LAN, a secured LAN (sniffing the victim IP is not really achievable in these two cases) - or a secured VPN (VPN allocated IP address is then defined by the VPN server). —> eWON team just doesn't understand how CSRF works. And continue to assume the device mgmt portal is accessible ONLY over the VPN, P2P LAN or secured LAN. They clearly have not looked at Shodan and / or publicly accessible portals. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *NOTE*: It should be - *An unauthorized / low-privileged user can perform several unauthorized actions such as reading, updating, & deleting I/O servers, configurations, enabling/disabling I/O servers, & accessing, deleting valid users.* *Scenario* Two users 1. adm - Default privileged user - can perform all administrative functions - full rights - [ v o a c f e h j ] 2. test - newly created user - no rights - no [ v o a c f e h j ] *Issue 1* *It is possible to enumerate valid I/O servers* I/O Server list is a set defined list: MEM cbIOSrvList=0 EWON cbIOSrvList=1 MODBUS cbIOSrvList=2 NETMPI ... SNMP cbIOSrvList=4 DF1 ... FINS ... so on ... & others An unauthorized / unprivileged user can gather information and status of these IO servers in the following manner: *Logged in as ‘test'* Access - http://<IP>/rcgi.bin/Edit1IOSrvForm?cbIOSrvList=0&Ac2on=edit If Response says -> Not Configurable. -> Implies Not a valid I/O If Response says -> Access Denied -> Implies a valid I/O -> Window Title reveals the I/O server type - example, Modbus IO Server Config, DF1 1O Server Config, n so on *Issue 2* *It is possible to modify parameter values of I/O servers directly*Updating the values when logged in as 'test' Change POST request to GET Modify param values http://<IP>/rcgi.bin/EditUsrIOSrvForm?edCfgData=MinInterval%3A10%0D %0AMaxInterval%3A268435459%0D%0AReverseCount %3A0&B1=Update&AST_IOSrvNdx=1 Response -> IO Server config updated. Similarly, other I/O server configuration can be updated. In case an I/O server is not Enabled, it can be enabled and configured with custom values. *Following poc for SNMP I/O Server settings (This IO server communicates with any SNMP device)* Enabling and configuring SNMP I/O server (logged in as test) http://<IP>/rcgi.bin/EditAdvUsrIOSrvForm? edEnabledA=1&edGlobAddrA=&edPeriodA=&edGlobAddrB=&edPeriodB=&edGlo bAddrC=&edPeriodC=&B1=Update+Config&IOServer=SNMP -> IO Server config updated. *Issue 3* *Deleting All Users* It is possible for a user with no rights to: 1. Enumerate configured users 2. Delete any & all users. HTTP GET request to delete a user (when logged in as 'test') (unauthorized request) http://<IP>/rcgi.bin/EditForm?CB2=3&NbCB=4&Opera2onType=DeleteUser This brings up a confirmation prompt validating if we really want to delete the user. It presents the username and offers two options - Option 1 - Cancel and Confirm/Delete Option 2 - Select Confirm/Delete ..... Users List test Please confirm you want to delete these items Select Confirm/Delete ..... Next, the url redirects to DeleteForm which then shows Access denied twice ..... -> But the user gets deleted anyway. :) Verify by Refreshing User List *Enumerating Users* In order to enumerate valid users, we only need to submit the first DeleteUser request http://<IP>/rcgi.bin/EditForm?CB2=4&NbCB=3&Opera2onType=DeleteUser It will show the username. This process can of course be automated to view all valid application usernames. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *eWON considered WEAK RBAC issue a minor one. Apparently, they didn’t understood the impact at all.* eWON said: It's a minor issue as these informations are already available through eWON User Manual. We will however completely block the page in a future eWON firmware release when user credentials don't meet the requirements to avoid any ambiguity regarding eWON security. —> Regardless, the new firmware says this issue has been fixed.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *STORED CROSS-SITE SCRIPTING - NOT FIXED by eWON* CVE-2015-7927 *Vulnerable functions / parameters* Create / Edit User User First Name User Last Name User information Create / Edit Tag Tag Description …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Verified. Won't fix: We left the possibility to include HTML tags or javascript in form fields and form url parameters to meet some specific final user needs. Note that this kind of injection is achievable through FTP upload as everything is saved in the eWON config files. Furthermore all theses XSS exploit also require valid user authentication and rights. —> Yeah, it’s a feature and input validation is a useless practice anyway.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *Reflected XSS - NOT FIXED by eWON* Vulnerable parameter - AST_ErrorMsg http://<IP>/rcgi.bin/wsdForm?sys_Csave=1&AST_ErrorMsg=Success<script>alert("xss-AST_ErrorMsg")</ script>&sys_IpMbsSrvPort=502&sys_IpEipSrvPort=44818&sys_IpIsoSrvPort=102& sys_IpFinsSrvPort=9600&sys_TagPollMode=0&sys_IOTcpDefTO=1000&btUpdate= Update *PASSWORDS NOT SECURED - PARTIAL FIX by eWON* CVE-2015-7928 Passwords are passed in plain text allowing a malicious party to retrieve them from network traffic. The autocomplete setting of some eWON forms also allows these passwords to be retrieved from the browser. Compromise of the credentials would allow unauthenticated access. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says 2. Won't fix as the final user is supposed to configure eWON through VPN. —> Yeah, *supposed to*.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. *POST/GET ISSUES - NOT FIXED by eWON* CVE-2015-7929 eWON firmware web server allows the use of the HTML command GET in place of POST. GET is less secure because data that are sent are part of the URL. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Won't fix. This could be a problem regarding CRSF (issue B) but the final user is supposed to configure eWON through VPN (and thus https). Mitigating factors: This could be an issue regarding the CSRF attacks described above. However as already mentioned the eWON firmware exposure to CSRF attacks is really limited. Thus having equivalent POST and GET parameters handling for each request sent to the eWON webserver is by extension not problematic. —> Yeah, *supposed to*.. Not problematic... …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. -- Best Regards, Karn Ganeshen

Multiple cross-site scripting vulnerabilities were found in EUR.Remote users can exploit these vulnerabilities to execute malicious scripts.

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session. Juniper Networks ScreenOS versions 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 allow for an attacker to monitor and decrypt VPN traffic. ScreenOS is an operating system developed by Juniper Networks in the United States, and it mainly runs on the NetScreen series of firewall products. Successful exploits may allow an attacker to obtain sensitive information or gain unauthorized administrative access. This may aid in further attacks

Cisco Prime Network Services Controller 3.0 allows local users to bypass intended access restrictions and execute arbitrary commands via additional parameters to an unspecified command, aka Bug ID CSCus99427. A local attacker can exploit this issue to execute arbitrary commands in the context of the application. This may aid in further attacks. This issue being tracked by Cisco Bug ID CSCus99427. The software automates configuration changes to managed virtual networks through a single interface