| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <200904271758.n3RHwnVG005135@www5.securityfocus.com> Date: Mon, 27 Apr 2009 11:58:49 -0600 From: ddivulnalert@...frontline.com To: bugtraq@...urityfocus.com Subject: DDIVRT-2009-24 Precidia Ether232 Memory Corruption Title ----- DDIVRT-2009-24 Precidia Ether232 Memory Corruption Severity -------- Medium Date Discovered --------------- March 10th, 2009 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Steven James and princeofnigeria and r@...$ Vulnerability Description ------------------------- Certain Precidia Ether232 devices contain memory overwrite and authentication flaws. By making malformed GET requests to the built-in web server on certain Precidia Ether232 devices, it is possible to arbitrarily overwrite memory on the device and cause unknown impact. Solution Description -------------------- At this point in time, Precidia Technologies has not provided a firmware upgrade addressing the memory corruption flaw. As a workaround, Precidia Technologies suggests that users disable the web server on the device through the serial or telnet configuration interface. Tested Systems / Software (with versions) ------------------------------------------ Precidia Ether3201-232 w/ firmware 3.00.250 Precidia Ether232 Duo w/ firmware 5.00.02 Other versions are believed to be vulnerable. Vendor Contact -------------- Vendor Name: Precidia Technologies Vendor Website: http://www.precidia.com Contact Information: solutions@...cidia.com, support@...cidia.com
Powered by blists - more mailing lists