| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <0ad5b66a9c574aa3be543aafb45e7023@CitaEX.citadel.local>
Date: Sat, 6 Jul 2019 19:25:34 +0000
From: Eitan shav <eitan@...adel.co.il>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Polycom RealPresence Touch device vulnerable to Slowloris
attack (hardware version 7; OS version 2.1.2-255)
[Description]
Polycom RealPresence Touch devices (hardware version 7; operating
system version 2.1.2-255) allow remote attackers to cause a denial of
service (networking outage) by sending "Slowloris" packet data to the
login interface.
[VulnerabilityType]
Slowloris DoS
[Vendor of Product]
Polycom
[Affected Product Code Base]
RealPresence Touch device - Hardware version: 7 , operating system version: 2.1.2-255
[Attack Type]
Remote
[Has vendor confirmed or acknowledged the vulnerability?]
true
[Discoverer]
Eitan Shav from Citadel Cyber Security
[Reference]
https://www.poly.com/us/en
[Screenshots of POC]
1.The login page (before the attack): https://drive.google.com/open?id=1GFWdayd4Bllk9jGl6Z_ypzD7zkXTg-Rd
2.establishing the attack: https://drive.google.com/open?id=1yyBULB1LuWqbO4ZAqz-4XMJs6qlv4Q_l
3.Tying to access the login page (after the attack): https://drive.google.com/open?id=10Vp7U7RH6efX7c_V62jeq-umfyVI6o6O
[newt]
Download attachment "image002.png" of type "image/png" (18160 bytes)
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists