VARIoT IoT vulnerabilities database

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 and earlier allows remote attackers to cause a denial of service (CPU consumption) by flooding the router with traffic that generates a large number of ICMP Unreachable replies. Cisco 12000 When using a black hole filter in a series internet router, ICMP Service disruption when a large number of unreachable packets are sent (DoS) There is a vulnerability that becomes a condition.ICMP Service operation disruption by sending a large number of unreachable packets (DoS) There is a possibility of being in a state. Cisco 12000 Series Internet Routers are prone to a denial of service condition. Successful exploitation may cause the router to stop forwarding packets. This condition may occur when the router is "Black Hole" filtering. It should be noted that this vulnerability only affects certain Cisco 12000 Series Internet Routers, and other Cisco router products should not be considered vulnerable. Cisco classifies this issue under Vulnerability CSCdr46528, Vulnerability CSCds36541 and Vulnerability CSCdt66560. Engine 2 based Cisco 12000 with IOS 12.0 and line cards and earlier versions are vulnerable

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not block non-initial packet fragments, which allows remote attackers to bypass the ACL. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. Non-initial fragmented packets sent to a protected host will bypass the ACL. This could allow a user to communicate with 'protected' hosts, bypassing security policy. A remote attacker bypasses the ACL

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not handle the "fragment" keyword in a compiled ACL (Turbo ACL) for packets that are sent to the router, which allows remote attackers to cause a denial of service via a flood of fragments. IOS is the Cisco Internet Operating System, distributed with and used on various Cisco network hardware. A possible vulnerability in IOS on the 12000 series Cisco routers could make it possible for a remote user to send unauthorized traffic to a protected network. IOS for the Cisco 12000 has only recently added the ability to filter fragmented packets in outgoing traffic. If a 'fragment' rule in an outgoing ACL exists in a version without this feature, attackers may be able to evade it and send fragmented packets to a protect network. This vulnerability may result in attackers or users bypassing security policy

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly handle the implicit "deny ip any any" rule in an outgoing ACL when the ACL contains exactly 448 entries, which can allow some outgoing packets to bypass access restrictions. Cisco 12000 Series Internet Routers with line cards based on Engine 2 are prone to an unusual issue where they may fail to drop packets. The result is that some packets will not be dropped, potentially allowing restricted traffic into the network. Cisco has assigned Vulnerability CSCdu03323 to this issue. Some outgoing packets bypass access restrictions

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the "fragment" keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. The keyword "fragment" in a compiled (turbo) ACL will be ignored when evaluating packets that are addressed to the router itself. Cisco has assigned Vulnerability CSCdu57417 to this issue. Fragmented packets violate expected access

Cisco 12000 with IOS 12.0 and lines card based on Engine 2 does not properly handle an outbound ACL when an input ACL is not configured on all the interfaces of a multi port line card, which could allow remote attackers to bypass the intended access controls. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. This may be the case when input ACL is configured on some, but not all, of the interfaces on the card. This vulnerability will occur only when the packets in question are not blocked by an inbound ACL on the ingress port. An ACL applied to incoming packets will still behave as expected. Remote attacker bypasses intended access controls

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. IOS on Cisco 12000 series routers with Engine 2 based cards may fail to block intended traffic using outgoing ACLs. Outgoing ACL lists do not support the keyword 'fragment', and will ignore it. If the keyword is included in the ACL, fragmented packets will not be evaluated against the associated rules, possibly bypassing security policy

IOS is the Cisco Internet Operating System, distributed with and used on various Cisco network hardware. A vulnerability in IOS on the 12000 series Cisco routers could make it possible for a remote user to send unauthorized traffic to a protected network. IOS does not filter packet fragments, even when the 'fragment' keyword is included in an ACL rule. This vulnerability may result in attackers or users bypassing security policy.

PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHP_SELF variable and makes it appear that case.filemanager.php is being called by admin.php instead of the user. PHP Nuke is a web portal creation and management package, implemented in the PHP scripting language. The default installation includes the script 'admin/case/case.filemanager.php', which can be used to copy and delete files on the server file system. While the script contains code used to ensure it is only called by an administrative script responsible for user authentication, the implementation of this is flawed. As a result, any remote user may call the script directly without authenticating, and copy and delete any file on the server, subject to the user permissions under which the script executes. Vulnerabilities exist in PHP-Nuke version 5.2

Linear key exchange process in High-bandwidth Digital Content Protection (HDCP) System allows remote attackers to access data as plaintext, avoid device blacklists, clone devices, and create new device keyvectors by computing and using alternate key combinations for authentication. Intel's High-bandwidth Digital Content Protection (HDCP) is a specification for authentication and encryption of multimedia streams. Content encryption and authentication of a playback device are based on a public/private key pair. Authentication is accomplished by a linear combination of private key values, based on the public key. As a direct result, being able to express an arbitrary public key as a linear combination of known public/private key pairs allows an attacker to authenticate as the arbitrary device. This results in a large number of possible exploits, with varying degrees of computation required. As an example, an attacker able to eavesdrop on an encrypted stream may compute the shared secret, and view the decrypted content. Although a computationally efficient algorithm has not yet been published, it may also be possible to create new, valid keys that are a linear combination of known values. Currently this may be done by enumerating all possible well formed public keys, and testing for validity

BUGTRAQ ID: 3475PC-to-Phone is an application that can use the IP phone service to implement the function of making calls from PC to phone or from PC to PC. It is maintained by iConnectHere and copyrighted by deltathree. The software was found to have a security issue that could lead to the disclosure of PC-to-Phone confidential authentication information. If a user is in a multi-user system and has read permissions to the "temp.html" file, it is possible to obtain the user account and password for the current login to the system from the file. This file is globally readable by default. & lt; * Source: Arthur Hagen (& lt; a href = 'mailto: art@broomstick.com'> art@broomstick.com< / a>) Link: & lt; a href = 'http: //archives.neohapsis.com /archives/bugtraq/2001-10/0239.html '> http://archives.neohapsis.com/archives/bugtraq/2001-10/0239.html</a> *>

Check Point VPN-1 4.1SP4 using SecuRemote returns different error messages for valid and invalid users, with prompts that vary depending on the authentication method being used, which makes it easier for remote attackers to conduct brute force attacks. VPN-1 is a popular secure remote access software package, distributed and maintained by Check Point. A problem with the software package makes it possible for a user to gain potential access. This increases the chances of a remote attacker launching a successful brute force attack against a VPN-1 server. This vulnerability affects Windows NT and 2000 implementations. The prompt changes depending on the authentication method used

Internet Explorer 5.1 for Macintosh on Mac OS X allows remote attackers to execute arbitrary commands by causing a BinHex or MacBinary file type to be downloaded, which causes the files to be executed if automatic decoding is enabled. BinHex and MacBinary are binary file types used by the Macintosh operating systems. Earlier versions of Internet Explorer have not been tested, but may also be vulnerable. Internet Explorer 5.1 for Macintosh under the Mac OS X platform has a vulnerability

Buffer overflow in Claris Emailer 2.0v2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an email attachment with a long filename. Claris Emailer is an email program developed by Claris. A vulnerability exists in Claris emailer which could cause the application to stop responding. A restart of the application may be required in order to regain normal functionality. It may be possible for remote attackers to execute arbitrary code

Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers (ISN), which allows remote attackers to spoof or hijack TCP connections. CBOS is prone to a remote security vulnerability

Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via an ICMP ECHO REQUEST (ping) with the IP Record Route option set. CBOS is prone to a denial-of-service vulnerability. Cisco CBOS 2.3.8 and earlier versions are vulnerable

Cisco CBOS 2.3.8 and earlier stores the passwords for (1) exec and (2) enable in cleartext in the NVRAM and a configuration file, which could allow unauthorized users to obtain the passwords and gain privileges. CBOS is prone to a remote security vulnerability

Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via a series of large ICMP ECHO REPLY (ping) packets, which cause it to enter ROMMON mode and stop forwarding packets. CBOS is prone to a denial-of-service vulnerability. Cisco CBOS 2.3.8 and earlier versions are vulnerable

NetInfo Manager for Mac OS X 10.0 through 10.1 allows local users to gain root privileges by opening applications using the (1) "recent items" and (2) "services" menus, which causes the applications to run with root privileges. As a result, an attacker can have arbitrary programs executed with root privileges. This problem is not exclusive to the 'Recent Items' list. The 'Services' menu is also prone to this issue. A vulnerability exists in NetInfo Manager for Mac OS X versions 10.0 through 10.1

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes.". Wireshark contains a vulnerability in the XOT dissector that may cause the application to crash. A flaw in the OpenSSL library could allow a remote attacker to cause a denial of service on an affected application. Multiple RSA implementations fail to properly handle RSA signatures. This vulnerability may allow an attacker to forge RSA signatures. The NSS libraries used in the Sun One Application Server and the Sun Java System web server contain an unspecified vulnerability that may allow an attacker to create a denial-of-service condition. An attacker may exploit this issue to sign digital certificates or RSA keys and take advantage of trust relationships that depend on these credentials, possibly posing as a trusted party and signing a certificate or key. All versions prior to and including OpenSSL 0.9.7j and 0.9.8b are affected by this vulnerability. Updates are available. ---------------------------------------------------------------------- Want to work within IT-Security? Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit. Currently the following type of positions are available: http://secunia.com/quality_assurance_analyst/ http://secunia.com/web_application_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/ ---------------------------------------------------------------------- TITLE: gzip Multiple Vulnerabilities SECUNIA ADVISORY ID: SA21996 VERIFY ADVISORY: http://secunia.com/advisories/21996/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: gzip 1.x http://secunia.com/product/4220/ DESCRIPTION: Tavis Ormandy has reported some vulnerabilities in gzip, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system. 1) A boundary error within the "make_table()" function in unlzh.c can be used to modify certain stack data. tricking a user or automated system into unpacking a specially crafted archive file. tricking a user or automated system into unpacking a specially crafted "pack" archive file. 3) A buffer overflow within the "make_table()" function of gzip's LZH support can be exploited to cause a DoS and potentially to compromise a vulnerable system by e.g. tricking a user or automated system into unpacking an archive containing a specially crafted decoding table. 4) A NULL pointer dereference within the "huft_build()" function and an infinite loop within the LZH handling can be exploited to cause a DoS by e.g. tricking a user or automated system into unpacking a specially crafted archive file. The vulnerabilities have been reported in version 1.3.5. SOLUTION: Do not unpack untrusted archive files. PROVIDED AND/OR DISCOVERED BY: Tavis Ormandy, Google Security Team ORIGINAL ADVISORY: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204676 OTHER REFERENCES: US-CERT VU#554780: http://www.kb.cert.org/vuls/id/554780 US-CERT VU#381508: http://www.kb.cert.org/vuls/id/381508 US-CERT VU#773548: http://www.kb.cert.org/vuls/id/773548 US-CERT VU#933712: http://www.kb.cert.org/vuls/id/933712 US-CERT VU#596848 http://www.kb.cert.org/vuls/id/596848 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-333A Apple Releases Security Update to Address Multiple Vulnerabilities Original release date: November 29, 2006 Last revised: -- Source: US-CERT Systems Affected * Apple Mac OS X version 10.3.x and 10.4.x * Apple Mac OS X Server version 10.3.x and 10.4.x * Apple Safari web browser These vulnerabilities affect both Intel-based and PowerPC-based Apple systems. Overview Apple has released Security Update 2006-007 to correct multiple vulnerabilities affecting Mac OS X, Mac OS X Server, Safari web browser. Vulnerabilities in OpenSSL, gzip, and other products are also addressed. I. Description Apple Security Update 2006-007 addresses a number of vulnerabilities affecting Mac OS X, OS X Server, Safari web browser, and other products. Further details are available in the related vulnerability notes. This security update also addresses previously known vulnerabilities in PHP, Perl, OpenSSL, and gzip, which are shipped with Mac OS X. Information is also available through the OpenSSL vulnerabilities page. Information about the vulnerabilities in gzip is available in a series of vulnerability notes. II. Impact The impacts of these vulnerabilities vary. For specific details, see the appropriate vulnerability notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. Solution Install updates Install Apple Security Update 2006-007. IV. References * Vulnerability Notes for Apple Security Update 2006-007 - <http://www.kb.cert.org/vuls/byid?searchview&query=apple-2006-007> * Vulnerability Notes for OpenSSL Security Advisory [28th September 2006] - <http://www.kb.cert.org/vuls/byid?searchview&query=openssl_secadv_20060928> * Vulnerability Note VU#845620 - <http://www.kb.cert.org/vuls/id/845620> * Vulnerability Note VU#933712 - <http://www.kb.cert.org/vuls/id/933712> * Vulnerability Note VU#381508 - <http://www.kb.cert.org/vuls/id/381508> * Vulnerability Note VU#554780 - <http://www.kb.cert.org/vuls/id/554780> * Vulnerability Note VU#596848 - <http://www.kb.cert.org/vuls/id/596848> * Vulnerability Note VU#773548 - <http://www.kb.cert.org/vuls/id/773548> * About the security content of Security Update 2006-007 - <http://docs.info.apple.com/article.html?artnum=304829> * Mac OS X: Updating your software - <http://docs.info.apple.com/article.html?artnum=106704> * Apple Downloads - <http://www.apple.com/support/downloads/> * OpenSSL: OpenSSL vulnerabilities - <http://www.openssl.org/news/vulnerabilities.html> * Securing Your Web Browser - <http://www.us-cert.gov/reading_room/securing_browser/#Safari> _________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-333A.html> _________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-333A Feedback VU#191336" in the subject. _________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> _________________________________________________________________ Revision History November 29, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRW33NuxOF3G+ig+rAQJtiggApJKRh7x+z8vp0xb26sE16RUOD3epcrk6 lJZ4rXnqVqoFacAt0Ucb8T43/Uc4N85UMa695YbFspYZum3hcGZo+WnNPolGUeRz iN/4bfKgzekfpbHxf6T3YvQYp+PVMRfHPUcxfaZDYXhu2813N4SSQpM59KRL5BD7 xr+5VvB09biVKlzpEdgtk2EHcqc+sMF5+o3cCgDJCnJNL+NG4J6d/hsyNP15ekTf 8m0W4rJonUe2gR2Bp7F1Y47KgRr3BT1aH2gxUSim9qEJpPdP/CkmGoFp+BfrFP9q A580LOrqFK8HIly1fbPKb26p2theUUESnQqM9Ob8xolkCDLy6h7ssg== =f7N+ -----END PGP SIGNATURE-----