Secure Elements Class 5 AVR Multiple Remote Vulnerabilities
BID:18191
Info
Secure Elements Class 5 AVR Multiple Remote Vulnerabilities
| Bugtraq ID: | 18191 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2006 12:00AM |
| Updated: | May 31 2006 10:57PM |
| Credit: | NCIRT lab discovered these vulnerabilities. |
| Vulnerable: |
Secure Elements Class 5 EVM 0 Secure Elements Class 5 AVR 0 |
| Not Vulnerable: |
Secure Elements Class 5 EVM 2.8.1 |
Discussion
Secure Elements Class 5 AVR Multiple Remote Vulnerabilities
Secure Elements Class 5 AVR (Automated Vulnerability Remediation) is susceptible to multiple vulnerabilities. These issues affect both clients and servers.
These vulnerabilities allow remote attackers to:
- gain access to potentially sensitive information
- gain administrative access to the application
- overwrite arbitrary files on servers with superuser privileges
- forge client messages
- distribute malicious update content to clients
- replay and modify messages
- execute arbitrary machine code with superuser privileges on client computers
- cause denial-of-service conditions in clients and servers
Other attacks may also be possible.
Secure Elements Class 5 AVR has been renamed to EVM (Enterprise Vulnerability Management). Class 5 EVM versions prior to 2.8.1 and Class 5 AVR are vulnerable to these issues.
Secure Elements Class 5 AVR (Automated Vulnerability Remediation) is susceptible to multiple vulnerabilities. These issues affect both clients and servers.
These vulnerabilities allow remote attackers to:
- gain access to potentially sensitive information
- gain administrative access to the application
- overwrite arbitrary files on servers with superuser privileges
- forge client messages
- distribute malicious update content to clients
- replay and modify messages
- execute arbitrary machine code with superuser privileges on client computers
- cause denial-of-service conditions in clients and servers
Other attacks may also be possible.
Secure Elements Class 5 AVR has been renamed to EVM (Enterprise Vulnerability Management). Class 5 EVM versions prior to 2.8.1 and Class 5 AVR are vulnerable to these issues.
Exploit / POC
Secure Elements Class 5 AVR Multiple Remote Vulnerabilities
Some of these issues may not require specific exploit code.
Currently we are not aware of any exploits for these issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Some of these issues may not require specific exploit code.
Currently we are not aware of any exploits for these issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
Secure Elements Class 5 AVR Multiple Remote Vulnerabilities
Solution:
Version 2.8.1 of Class 5 EVM is available to address these issues.
Solution:
Version 2.8.1 of Class 5 EVM is available to address these issues.
References
Secure Elements Class 5 AVR Multiple Remote Vulnerabilities
References:
References:
- Secure Elements Products Page (Secure Elements)
- Vulnerability Note VU#135529 (US-CERT)
- Vulnerability Note VU#207161 (US-CERT)
- Vulnerability Note VU#207337 (US-CERT)
- Vulnerability Note VU#227929 (US-CERT)
- Vulnerability Note VU#288121 (US-CERT)
- Vulnerability Note VU#346377 (US-CERT)
- Vulnerability Note VU#353769 (US-CERT)
- Vulnerability Note VU#353945 (US-CERT)
- Vulnerability Note VU#397417 (US-CERT)
- Vulnerability Note VU#456729 (US-CERT)
- Vulnerability Note VU#487617 (US-CERT)
- Vulnerability Note VU#566553 (US-CERT)
- Vulnerability Note VU#584329 (US-CERT)
- Vulnerability Note VU#635721 (US-CERT)
- Vulnerability Note VU#764025 (US-CERT)
- Vulnerability Note VU#873409 (US-CERT)
- Vulnerability Note VU#912217 (US-CERT)
- Vulnerability Note VU#919345 (US-CERT)
- Vulnerability Note VU#921017 (US-CERT)