Eric Sesterhenn

**Name of the Vulnerable Software and Affected Versions** ntpd-rs versions 1.2.0 through 1.6.1 **Description** ntpd-rs, a tool for synchronizing a computer's clock implementing the NTP and NTS protocols, contains a denial of service issue. When configured as a server, the software incorrectly responds to all NTP messages, including those from other servers. This can lead to a message storm between two ntpd-rs servers, consuming significant resources. Client-only configurations are not affected. **Recommendations** Upgrade to version 1.6.2 as soon as possible. If upgrading is not possible, mitigate the issue by whitelisting access to only client IP addresses using the ignore filter method. Block incoming non-request traffic on the NTP server port using a firewall. Disable public access to the vulnerable NTP server. Disable the server functionality by removing any [server] sections from the configuration.

**Nome do Software Vulnerável e Versões Afetadas** Gemalto (versões afetadas não especificadas) **Descrição** Existia uma possível vulnerabilidade de estouro de buffer na pilha no arquivo GemaltoKeyHandle.cpp. Este problema foi corrigido em SCSSU-201801. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Git versions prior to 2.30.7 **Description** The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both. **Recommendations** For Git versions prior to 2.30.7, upgrade to a version published on or after 2023-01-17 to resolve the issue. As a temporary workaround, consider restricting the use of the `.gitattributes` file until a patch is applied. Avoid using huge numbers of path patterns, attributes for a single pattern, or huge declared attribute names in the `.gitattributes` file to minimize the risk of exploitation.

**Nome do software vulnerável e versões afetadas** Versões do Psyprax anteriores à 3.2.2 **Descrição** Foi detectada uma falha em que o arquivo %PROGRAMDATA%Psyprax32PPScreen.ini contém um hash para a tela de bloqueio do aplicativo. Se essa entrada for removida, a tela de bloqueio deixa de ser exibida e o aplicativo não fica mais bloqueado. Todos os usuários locais podem modificar esse arquivo. **Recomendações** Para versões anteriores à 3.2.2, atualize para a versão 3.2.2 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso ao arquivo %PROGRAMDATA%Psyprax32PPScreen.ini para impedir que usuários locais o modifiquem.

**Nome do software vulnerável e versões afetadas** Versões do New Media Smarty anteriores à 9.10 **Descrição** Foi detectada uma falha em que as senhas são armazenadas no banco de dados em um formato ofuscado que pode ser facilmente revertido. O arquivo data.mdb contém essas senhas ofuscadas na segunda coluna. **Recomendações** Para versões anteriores à 9.10, atualize para a versão 9.10 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso ao arquivo data.mdb para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Versões do Epikur anteriores à 20.1.1 **Descrição** Foi descoberta uma falha no servidor Epikur, na qual a função `checkPasswort()` compara a senha enviada com o hash MD5 da senha do usuário armazenado no banco de dados e com um segundo hash MD5, que é o mesmo para todos os usuários, conhecido como “senha backdoor” de `3p1kursupport`. Se a senha enviada corresponder a qualquer um deles, o acesso é concedido. **Recomendações** Para versões anteriores à 20.1.1, atualize para a versão 20.1.1 ou posterior para resolver o problema. Como solução temporária, considere desativar a função `checkPasswort()` até que um patch esteja disponível. Restrinja o acesso à funcionalidade de login para minimizar o risco de exploração. Evite usar a senha backdoor `3p1kursupport` no sistema afetado até que o problema seja resolvido.

**Name of the Vulnerable Software and Affected Versions** HylaFAX version 6.0.6 HylaFAX+ version 5.6.0 **Description** The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file. **Recommendations** For HylaFAX version 6.0.6, consider disabling the `FaxModem::writeECMData()` function until a patch is available. For HylaFAX+ version 5.6.0, restrict access to the faxd/CopyQuality.c++ file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** An issue in the fax notify mail function in faxrec.c allows for a buffer overflow due to the `mail to` parameter not being sanitized. This could potentially lead to a denial of service if long untrusted input reaches it. The exploitation of this issue may cause a stack-based buffer overflow, allowing an attacker to disrupt service using the `mail to` parameter. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting input to the `fax notify mail` function to prevent long untrusted input from reaching the `mail to` parameter.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** A stack-based buffer overflow issue can be triggered via a command-line parameter in the contrib/scrts.c file. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** An issue was discovered in the contrib/next-login/login.c file, where the command-line parameter `username` is passed unsanitized to the strcpy() function, which can cause a stack-based buffer overflow. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation. Avoid using the `username` parameter in the affected login functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** An issue was discovered where the `mail to` parameter in the `fax notify mail()` function is not sanitized, potentially allowing for command injection if untrusted input can reach it due to the use of `popen`. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `fax notify mail()` function to minimize the risk of exploitation. Avoid using untrusted input for the `mail to` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue arises from endless recursion when handling responses from an IAS-ECC card in the iasecc select file function in libopensc/card-iasecc.c. This could be exploited by attackers who can supply crafted smartcards, potentially causing the opensc library to hang or crash when used by programs. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue concerns out of bounds reads when handling responses in OpenSC. Attackers who can supply crafted smartcards may potentially crash the opensc library using programs. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** A double free issue when handling responses from a smartcard in the sc file set sec attr function in libopensc/sc.c could be used by attackers to cause a denial of service, potentially leading to an application crash, or possibly having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from an ePass 2003 Card in the `decrypt response` function in `libopensc/card-epass2003.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from a Cryptoflex card in the `read public key` function in `tools/cryptoflex-tool.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `read public key` function in `tools/cryptoflex-tool.c` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** A buffer overflow issue exists when handling string concatenation in the `util acl to str` function in `tools/util.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from a CAC Card in the `cac get serial nr from CUID` function in `libopensc/card-cac.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** A double free issue exists when handling responses in the read file function in tools/egk-tool.c, which could allow attackers to cause a denial of service or possibly have other unspecified impacts by supplying crafted smartcards. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from a Gemsafe V1 Smartcard in the `gemsafe get cert len` function in `libopensc/pkcs15-gemsafeV1.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts. **Recommendations** For OpenSC versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue.