VARIoT IoT vulnerabilities database

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash. BlueZ Contains a vulnerability regarding the lack of free memory after expiration.Service operation interruption (DoS) It may be in a state. BlueZ has a resource management error vulnerability. The vulnerability stems from a vulnerability in the cstate alloc buf of the sdp in the affected version. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Low: bluez security update Advisory ID: RHSA-2022:2081-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:2081 Issue date: 2022-05-10 CVE Names: CVE-2021-41229 ===================================================================== 1. Summary: An update for bluez is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Red Hat), and pcmcia configuration files. Security Fix(es): * bluez: memory leak in the SDP protocol (CVE-2021-41229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2025034 - CVE-2021-41229 bluez: memory leak in the SDP protocol 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: bluez-cups-5.56-3.el8.aarch64.rpm bluez-cups-debuginfo-5.56-3.el8.aarch64.rpm bluez-debuginfo-5.56-3.el8.aarch64.rpm bluez-debugsource-5.56-3.el8.aarch64.rpm bluez-hid2hci-debuginfo-5.56-3.el8.aarch64.rpm bluez-libs-debuginfo-5.56-3.el8.aarch64.rpm bluez-obexd-debuginfo-5.56-3.el8.aarch64.rpm ppc64le: bluez-cups-5.56-3.el8.ppc64le.rpm bluez-cups-debuginfo-5.56-3.el8.ppc64le.rpm bluez-debuginfo-5.56-3.el8.ppc64le.rpm bluez-debugsource-5.56-3.el8.ppc64le.rpm bluez-hid2hci-debuginfo-5.56-3.el8.ppc64le.rpm bluez-libs-debuginfo-5.56-3.el8.ppc64le.rpm bluez-obexd-debuginfo-5.56-3.el8.ppc64le.rpm s390x: bluez-cups-5.56-3.el8.s390x.rpm bluez-cups-debuginfo-5.56-3.el8.s390x.rpm bluez-debuginfo-5.56-3.el8.s390x.rpm bluez-debugsource-5.56-3.el8.s390x.rpm bluez-hid2hci-debuginfo-5.56-3.el8.s390x.rpm bluez-libs-debuginfo-5.56-3.el8.s390x.rpm bluez-obexd-debuginfo-5.56-3.el8.s390x.rpm x86_64: bluez-cups-5.56-3.el8.x86_64.rpm bluez-cups-debuginfo-5.56-3.el8.x86_64.rpm bluez-debuginfo-5.56-3.el8.x86_64.rpm bluez-debugsource-5.56-3.el8.x86_64.rpm bluez-hid2hci-debuginfo-5.56-3.el8.x86_64.rpm bluez-libs-debuginfo-5.56-3.el8.x86_64.rpm bluez-obexd-debuginfo-5.56-3.el8.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: bluez-5.56-3.el8.src.rpm aarch64: bluez-5.56-3.el8.aarch64.rpm bluez-cups-debuginfo-5.56-3.el8.aarch64.rpm bluez-debuginfo-5.56-3.el8.aarch64.rpm bluez-debugsource-5.56-3.el8.aarch64.rpm bluez-hid2hci-5.56-3.el8.aarch64.rpm bluez-hid2hci-debuginfo-5.56-3.el8.aarch64.rpm bluez-libs-5.56-3.el8.aarch64.rpm bluez-libs-debuginfo-5.56-3.el8.aarch64.rpm bluez-obexd-5.56-3.el8.aarch64.rpm bluez-obexd-debuginfo-5.56-3.el8.aarch64.rpm ppc64le: bluez-5.56-3.el8.ppc64le.rpm bluez-cups-debuginfo-5.56-3.el8.ppc64le.rpm bluez-debuginfo-5.56-3.el8.ppc64le.rpm bluez-debugsource-5.56-3.el8.ppc64le.rpm bluez-hid2hci-5.56-3.el8.ppc64le.rpm bluez-hid2hci-debuginfo-5.56-3.el8.ppc64le.rpm bluez-libs-5.56-3.el8.ppc64le.rpm bluez-libs-debuginfo-5.56-3.el8.ppc64le.rpm bluez-obexd-5.56-3.el8.ppc64le.rpm bluez-obexd-debuginfo-5.56-3.el8.ppc64le.rpm s390x: bluez-5.56-3.el8.s390x.rpm bluez-cups-debuginfo-5.56-3.el8.s390x.rpm bluez-debuginfo-5.56-3.el8.s390x.rpm bluez-debugsource-5.56-3.el8.s390x.rpm bluez-hid2hci-5.56-3.el8.s390x.rpm bluez-hid2hci-debuginfo-5.56-3.el8.s390x.rpm bluez-libs-5.56-3.el8.s390x.rpm bluez-libs-debuginfo-5.56-3.el8.s390x.rpm bluez-obexd-5.56-3.el8.s390x.rpm bluez-obexd-debuginfo-5.56-3.el8.s390x.rpm x86_64: bluez-5.56-3.el8.x86_64.rpm bluez-cups-debuginfo-5.56-3.el8.i686.rpm bluez-cups-debuginfo-5.56-3.el8.x86_64.rpm bluez-debuginfo-5.56-3.el8.i686.rpm bluez-debuginfo-5.56-3.el8.x86_64.rpm bluez-debugsource-5.56-3.el8.i686.rpm bluez-debugsource-5.56-3.el8.x86_64.rpm bluez-hid2hci-5.56-3.el8.x86_64.rpm bluez-hid2hci-debuginfo-5.56-3.el8.i686.rpm bluez-hid2hci-debuginfo-5.56-3.el8.x86_64.rpm bluez-libs-5.56-3.el8.i686.rpm bluez-libs-5.56-3.el8.x86_64.rpm bluez-libs-debuginfo-5.56-3.el8.i686.rpm bluez-libs-debuginfo-5.56-3.el8.x86_64.rpm bluez-obexd-5.56-3.el8.x86_64.rpm bluez-obexd-debuginfo-5.56-3.el8.i686.rpm bluez-obexd-debuginfo-5.56-3.el8.x86_64.rpm Red Hat CodeReady Linux Builder (v. 8): aarch64: bluez-cups-debuginfo-5.56-3.el8.aarch64.rpm bluez-debuginfo-5.56-3.el8.aarch64.rpm bluez-debugsource-5.56-3.el8.aarch64.rpm bluez-hid2hci-debuginfo-5.56-3.el8.aarch64.rpm bluez-libs-debuginfo-5.56-3.el8.aarch64.rpm bluez-libs-devel-5.56-3.el8.aarch64.rpm bluez-obexd-debuginfo-5.56-3.el8.aarch64.rpm ppc64le: bluez-cups-debuginfo-5.56-3.el8.ppc64le.rpm bluez-debuginfo-5.56-3.el8.ppc64le.rpm bluez-debugsource-5.56-3.el8.ppc64le.rpm bluez-hid2hci-debuginfo-5.56-3.el8.ppc64le.rpm bluez-libs-debuginfo-5.56-3.el8.ppc64le.rpm bluez-libs-devel-5.56-3.el8.ppc64le.rpm bluez-obexd-debuginfo-5.56-3.el8.ppc64le.rpm s390x: bluez-cups-debuginfo-5.56-3.el8.s390x.rpm bluez-debuginfo-5.56-3.el8.s390x.rpm bluez-debugsource-5.56-3.el8.s390x.rpm bluez-hid2hci-debuginfo-5.56-3.el8.s390x.rpm bluez-libs-debuginfo-5.56-3.el8.s390x.rpm bluez-libs-devel-5.56-3.el8.s390x.rpm bluez-obexd-debuginfo-5.56-3.el8.s390x.rpm x86_64: bluez-cups-debuginfo-5.56-3.el8.i686.rpm bluez-cups-debuginfo-5.56-3.el8.x86_64.rpm bluez-debuginfo-5.56-3.el8.i686.rpm bluez-debuginfo-5.56-3.el8.x86_64.rpm bluez-debugsource-5.56-3.el8.i686.rpm bluez-debugsource-5.56-3.el8.x86_64.rpm bluez-hid2hci-debuginfo-5.56-3.el8.i686.rpm bluez-hid2hci-debuginfo-5.56-3.el8.x86_64.rpm bluez-libs-debuginfo-5.56-3.el8.i686.rpm bluez-libs-debuginfo-5.56-3.el8.x86_64.rpm bluez-libs-devel-5.56-3.el8.i686.rpm bluez-libs-devel-5.56-3.el8.x86_64.rpm bluez-obexd-debuginfo-5.56-3.el8.i686.rpm bluez-obexd-debuginfo-5.56-3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-41229 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYnqRLtzjgjWX9erEAQhLSQ//ZwYEUw8IqRkMhaXHWMrPk50APquWo/Dk gIcV1Slmo0NTJMHosbYiJ6PFzQKcrPO36c1pXjPewLSvzY2Y8yp55E9Y9kUTMENn Ue2wFrM9hFqFhACbZlVDViwsnj9gp18n9DfPrtJzU0py8jJrkm1KMyiqtUzkoA6r P0jQl0q7GtU5TCerU8QOpc2bWcaOXD6dT5AwcgOWDyQ9CU38nuIXGrcdf6JkXybx T8nWOA4FNBMW5X0uISgeMrsxI0eT8sn0ww+i/cnOOA9QczqpKxy682NFbsWDwQWY u09h4MD4Voi+Skq/YTl4SWggsARXzHkq+MlTXLEGMdDMZcjOhB7eCkc9oIsXj9k6 fHc27bHU7TQRy2y5w/poDnU6LOlnavQAHT0LrDNj7PdCfZbvqorPSckrebkls7Ci iMo068XlAfWfIDT57yFEZNbd0WA+bVNZcPtQLzIVil8lxrSTtxXGC49xnNLA3Lay 87uJbXZLUsgC0PUHx1No2QYpqRCnDdamkh07R0OaMROyZZPyO3BGeyUHKtFNW6Zz UUlv1NwXN3d9E6K3mvaBQqYGbVae22y8SrJOL/qLM7e8E/FO2MM7kSzbdbwHTEIJ JWJomZXVtQkoQW0uw5REUleCDnrsfAkqgwsZAtmHXOcPBP6tlbR8o+BFUXo54J6S SSXzvHgRCmU= =VeS/ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . ========================================================================== Ubuntu Security Notice USN-5155-1 November 23, 2021 bluez vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 21.04 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in BlueZ. Software Description: - bluez: Bluetooth tools and daemons Details: It was discovered that BlueZ incorrectly handled the Discoverable status when a device is powered down. This could result in devices being powered up discoverable, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. (CVE-2021-3658) It was discovered that BlueZ incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause BlueZ to consume resources, leading to a denial of service. (CVE-2021-41229) It was discovered that the BlueZ gatt server incorrectly handled disconnects. (CVE-2021-43400) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: bluez 5.60-0ubuntu2.1 libbluetooth3 5.60-0ubuntu2.1 Ubuntu 21.04: bluez 5.56-0ubuntu4.3 libbluetooth3 5.56-0ubuntu4.3 Ubuntu 20.04 LTS: bluez 5.53-0ubuntu3.4 libbluetooth3 5.53-0ubuntu3.4 Ubuntu 18.04 LTS: bluez 5.48-0ubuntu3.6 libbluetooth3 5.48-0ubuntu3.6 In general, a standard system update will make all the necessary changes

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames. plural ASUS Router product firmware contains a vulnerability related to interaction frequency control.Service operation interruption (DoS) It may be in a state

A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session. (DoS) It may be in a state. IBM System x servers is a server of International Business Machines Corporation (IBM). Attackers can use this vulnerability to execute operating system commands through an authenticated SSH or Telnet session

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system andcan significantly aid in getting remote code access. AlquistManager Exists in a past traversal vulnerability.Information may be obtained. Alquist is an advanced conversational Ai robot. For interesting and engaging conversations with humans on trending topics such as movies, sports, news, etc. No detailed vulnerability details are currently provided

An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device. plural Motorola-branded Binatone Hubble Cameras contain an authentication vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Binatone Motorola-branded Camera is a Motorola-branded product camera produced by Binatone authorized by Binatone

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages. plural Motorola-branded Binatone Hubble The camera has a cryptographic strength vulnerability.Information may be obtained. Binatone Motorola-branded Camera is a Motorola brand product camera produced by Binatone authorized by Binatone

A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same network to perform a denial-of-service attack against the device. plural Motorola-branded Binatone Hubble Cameras contain a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. Binatone Motorola-branded Camera is a Motorola brand product camera authorized by Binatone Company

An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password. Binatone Motorola-branded Camera is a Motorola brand product camera authorized by Binatone Company

Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communication channel being accessible by an attacker. plural Motorola-branded Binatone Hubble Cameras contain a vulnerability related to sending sensitive information in plaintext.Information may be obtained. Binatone Motorola-branded Camera is a Motorola brand product camera authorized by Binatone Company

An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the device to access administrative pages that could result in information disclosure or device firmware update with verified firmware. plural Motorola-branded Binatone Hubble The camera has an unspecified vulnerability.Information may be obtained. Binatone Motorola-branded Camera is a Motorola-branded camera produced by Binatone authorized by Binatone

Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA could potentially exploit this vulnerability, leading to a denial of service over SMB. Dell PowerScale OneFS contains an improper synchronization vulnerability.Service operation interruption (DoS) It may be in a state

Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. This vulnerability is triggered when upgrading from a previous versions. Dell EMC PowerScale OneFS Exists in unspecified vulnerabilities.Information may be obtained

A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi. Antilles An uncontrolled search path element vulnerability exists in open source software.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. When parsing the uuid request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14110. Zero Day Initiative To this vulnerability ZDI-CAN-14110 Was numbering.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NETGEAR R6400v2 is a router from Netgear. A hardware device that connects two or more networks and acts as a gateway between the networks

A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. It exists in the client code when processing a malformed IE length of HT capability information in the Beacon and Association response frame. Realtek RTL8195AM A classic buffer overflow vulnerability exists on the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Realtek RTL8195AM is an IoT microcontroller from Taiwan Realtek Semiconductor (Realtek). The Realtek RTL8195AM version before 2.0.10 has a buffer error vulnerability

On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi