lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <F54AFA453358C34D8763E073549997282A6974@CPEMS-KPN515.KPNCNL.LOCAL>
Date: Mon, 14 Nov 2016 10:43:40 +0000
From: <vincent.ruijter@....com>
To: <bugtraq@...urityfocus.com>
Subject: Multiple vulnerabilities in Barco Clickshare

CVE-2016-3149 - Remote Code Execution in Barco ClickShare CSC-1 and CSM-1
Affected versions: all versions prior to v01.09.03 (CSC-1) and v01.06.02 (CSM-1).
A remote code execution vulnerability exists within the Barco ClickShare base unit software, that could lead to full compromise of the appliance.

CVE-2016-3150 - Cross-site Scripting in Barco ClickShare CSC-1, CSM-1 and CSE-200
Affected versions:  all versions prior to v01.09.03 (CSC-1), v01.06.02 (CSM-1) and v01.03.02 (CSE-200)
A Cross-Site Scripting vulnerability exists within Barco ClickShare's CSC-1 base unit's wallpaper.php due to invalid input and output sanitisation. 

CVE-2016-3151 - Path Traversal in Barco ClickShare CSC-1, CSM-1 and CSE-200
Affected versions: all versions prior to v01.09.03 (CSC-1),  v01.06.02 (CSM-1) and v01.03.02 (CSE-200).
A Path Traversal vulnerability exists within Barco ClickShare's wallpaper parsing functionality, which leads to disclosure of the /etc/shadow file on the file system. 

CVE-2016-3152 - /etc/shadow file disclosure in the CSC-1 firmware update
Affected versions: all versions prior to v01.09.03 (CSC-1)
It is possible to download and extract the firmware image of the CSC-1 and obtain the root password.

The vendor has acknowledged and patched the aforementioned issues. It is recommended to download and apply the most recent firmware update for your appliance.

References:
http://www.barco.com/en/mybarco/mysupport/documentation/software/software-detail?nr=R33050020&rev=001002000009
http://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=R33050037&rev=001001000113
https://www.barco.com/en/mybarco/mysupport/productsupport/software/software-detail?nr=R33050070&rev=001001000008

--

Regards,

Vincent Ruijter
Ethical Hacker
Chief Information Security Office
KPN B.V.



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ