PT-2015-6985 · Chrysler · Connect

Chris Valasek + 1 · Publicado 2015-07-21 · Atualizado 2016-12-24 · CVE-2015-5611

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Uconnect versions prior to 15.26.1

Description The issue allows remote attackers in the same cellular network to control vehicle movement, cause human harm or physical damage, or modify dashboard settings. This is achieved via vectors related to modification of entertainment-system firmware and access of the CAN bus due to insufficient "Radio security protection." A demonstration of this issue was performed on a 2014 Jeep Cherokee Limited FWD.

Recommendations For versions prior to 15.26.1, update to version 15.26.1 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2015-5611

Produtos afetados

Connect

Referências · 12

• http://blog.fcanorthamerica.com/2015/07/22/unhacking-the-hacked-jeep · Nota
• http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483036/RCLRPT-15V461-9407.pdf · Nota
• https://twitter.com/0xcharlie/status/623171594349842433 · Nota
• https://youtube.com/watch?v=MK0SrxBC1xs&feature=youtu.be · Nota
• https://twitter.com/0xcharlie/status/623195051296993280 · Nota
• http://securityfocus.com/bid/75993 · Nota
• http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/UCM483033/RCAK-15V461-4967.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5611 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-15-260-01 · Nota
• https://twitter.com/0xcharlie/status/623258479730552832 · Nota
• http://media.fcanorthamerica.com/newsrelease.do?id=16827&mid=1 · Nota
• http://wired.com/2015/07/hackers-remotely-kill-jeep-highway · Nota