Author Archives: CERT

VU#166743: Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities

Posted on by

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode,U-Boot’s use of a zero initialization vector and improper handling of an error condition may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Continue reading VU#166743: Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities→

VU#112992: Apache Struts 2 framework REST plugin insecurely deserializes untrusted XML data

Posted on by

Apache Struts 2 framework,versions 2.5 to 2.5.12,with REST plugin insecurely deserializes untrusted XML data. A remote,unauthenticated attacker can leverage this vulnerability to execute arbitrary code in the context of the Struts application. Continue reading VU#112992: Apache Struts 2 framework REST plugin insecurely deserializes untrusted XML data→

VU#793496: Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency

Posted on by

Open Shortest Path First(OSPF)protocol implementations may improperly determine Link State Advertisement(LSA)recency for LSAs with MaxSequenceNumber. Attackers with the ability to transmit messages from a routing domain router may send specially crafted OSPF messages to poison routing tables within the domain. Continue reading VU#793496: Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency→

VU#793496: Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency

Posted on by

Open Shortest Path First(OSPF)protocol implementations may improperly determine Link State Advertisement(LSA)recency for LSAs with MaxSequenceNumber. Attackers with the ability to transmit messages from a routing domain router may send specially crafted OSPF messages to poison routing tables within the domain. Continue reading VU#793496: Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency→

VU#586501: Inmarsat AmosConnect8 Mail Client Vulnerable to SQL Injection and Backdoor Account

Posted on by

Inmarsat Solutions offers a shipboard email client service,AmosConnect 8(AC8),which was designed to be utilized over satellite networks in a highly optimized manner. IOActive has identified two security vulnerabilities in the client software:On-board ship network access could provide visibility of user names and passwords configured on the client device. A backdoor account has been identified in the client that provides full system privileges. This vulnerability could be exploited remotely. An attacker with high skill would be able to exploit this vulnerability. AmosConnect 8 has been deemed end of life,and no longer supported. Inmarsat customers must contact Inmarsat Customer Service to obtain the replacement mail client software. Continue reading VU#586501: Inmarsat AmosConnect8 Mail Client Vulnerable to SQL Injection and Backdoor Account→