Denis Andzakovic

**Name of the Vulnerable Software and Affected Versions** Idera Up.Time Monitoring Station versions up to and including 7.2 **Description** An unauthenticated arbitrary file upload issue exists. The `wizards/post2file.php` script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot, resulting in remote code execution as the web server user. **Recommendations** Update Idera Up.Time Monitoring Station to a version newer than 7.2. As a temporary workaround, restrict access to the `wizards/post2file.php` script.

Name of the Vulnerable Software and Affected Versions: Pi-hole versions up to 3.3 Description: An authenticated command injection issue exists, allowing an attacker to append OS commands to the domain string when adding a domain to the allowlist via the web interface. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface. Recommendations: For versions up to 3.3, update to a version later than 3.3 to patch the vulnerability. As a temporary workaround, consider restricting access to the allowlist feature in the web interface until a patch is applied. Avoid using the domain parameter in the allowlist feature via the web interface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** MicroK8s versions prior to 1.15.3 **Description** A privilege escalation issue allows a low-privilege user with local access to obtain root access to the host by provisioning a privileged container. **Recommendations** For versions prior to 1.15.3, update to MicroK8s 1.15.3 to resolve the issue. As a temporary workaround, consider restricting local access to prevent low-privilege users from provisioning privileged containers.

**Name of the Vulnerable Software and Affected Versions** atftp version 0.7.1 **Description** The issue is related to the `thread list mutex` mutex in the atftpd component of atftp. It does not properly lock the mutex before assigning the current thread data structure, leading to a potential denial of service attack due to a NULL pointer dereference. If `thread data` is NULL when assigned to `current`, and modified by another thread before a certain check in tftpd list.c, there is a crash when dereferencing `current->next`. This allows a remote attacker to cause a denial of service. **Recommendations** For atftp version 0.7.1, consider applying a patch that properly locks the `thread list mutex` mutex before assigning the current thread data structure to prevent the NULL pointer dereference. As a temporary workaround, consider restricting access to the atftpd service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** atftp version 0.7.1 **Description** A remote attacker may send a crafted packet to trigger a stack-based buffer overflow due to an insecurely implemented `strncpy` call. The issue is triggered by sending an error packet of 3 bytes or fewer. The vulnerable `strncpy` pattern is found within multiple files, including `tftpd file.c`, `tftp file.c`, `tftpd mtftp.c`, and `tftp mtftp.c`. **Recommendations** For atftp version 0.7.1, consider restricting access to the `atftpd` service until a patch is available to prevent exploitation of the buffer overflow vulnerability. As a temporary workaround, avoid using the `strncpy` function in the affected code files until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Up.Time Monitoring Station versions 7.4.0 (build 13) through 7.5.0 (build 16) **Description** An issue in post2file.php allows an attacker to upload arbitrary files, including .php files that can execute arbitrary OS commands. **Recommendations** For versions 7.4.0 (build 13) through 7.5.0 (build 16), consider restricting access to the post2file.php script until a fix is available. As a temporary workaround, disabling the execution of uploaded files can help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Network Manager VPNC plugin versions prior to 1.2.6 **Description** The issue allows for a privilege escalation attack. An attacker can inject a `Password helper` parameter into the configuration data passed to VPNC by using a new line character, enabling the execution of arbitrary commands as root. **Recommendations** For versions prior to 1.2.6, update to version 1.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the VPNC plugin to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Phusion Passenger versions 3.x through 5.x before 5.3.2 **Description** The issue is related to a race condition in the nginx module of Phusion Passenger, which can be exploited when a non-standard `passenger instance registry dir` with insufficiently strict permissions is configured. This can allow a remote attacker to access sensitive data or a local attacker to escalate privileges by replacing a file with a symlink after the file was created but before it was chowned, potentially targeting sensitive files. **Recommendations** For Phusion Passenger versions 3.x through 5.x before 5.3.2, update to version 5.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `passenger instance registry dir` to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.11 Linux kernel versions 4.9.x before 4.9.187 Description: An issue was discovered in the Linux kernel that allows an attacker to control a pointer in kernel land and cause a general protection fault, or potentially execute arbitrary code under certain circumstances. This can be triggered as root or after namespace unsharing, and it occurs because `sk type` and `protocol` are not checked in the appropriate part of the `ip6 mroute *` functions. The issue can also lead to a local escalation of privilege with no additional execution privileges needed, due to a logic error in the code that results in a possible out of bounds write in `ip6 mroute setsockopt` and related functions. Recommendations: For Linux kernel versions prior to 4.11, update to version 4.11 or later to resolve the issue. For Linux kernel versions 4.9.x, update to version 4.9.187 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `ip6 mroute *` functions and the `CAP NET ADMIN` capability to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenLDAP versions 2.4.42 and earlier **Description** The issue allows remote attackers to cause a denial of service, resulting in an application crash, via crafted BER data. This can be demonstrated by an attack against slapd. **Recommendations** For OpenLDAP versions 2.4.42 and earlier, consider updating to a version that contains a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FortiOS version 5.0 Patch 7 build 4457 **Description** The CAPWAP DTLS protocol implementation in FortiOS uses the same certificate and private key across different customers' installations. However, according to FG-IR-15-002, the Fortinet Factory certificate is unique to each device, which contradicts the initial statement. This discrepancy suggests confusion regarding the uniqueness of the certificate. If the certificate is indeed not unique, it could make it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet Factory certificate and private key. **Recommendations** For FortiOS version 5.0 Patch 7 build 4457, consider disabling the use of the Fortinet Factory certificate and private key until a patch or clarification is available. However, given the contradiction in information, it's essential to consult official Fortinet resources for accurate guidance on mitigating potential risks associated with the CAPWAP DTLS protocol implementation. At the moment, there is no clear information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** FortiClient versions 5.2.3.091 for Android and 5.2.028 for iOS **Description** The issue is related to the Endpoint Control protocol implementation, which does not validate certificates. This makes it easier for man-in-the-middle attackers to spoof servers via a crafted certificate. **Recommendations** For FortiClient version 5.2.3.091 on Android, consider disabling the Endpoint Control protocol until a patch is available. For FortiClient version 5.2.028 on iOS, consider disabling the Endpoint Control protocol until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Fortinet FortiClient version 5.2.028 for iOS **Description** The issue makes it easier for man-in-the-middle attackers to spoof SSL VPN servers via a crafted certificate, as it does not validate certificates. **Recommendations** For Fortinet FortiClient version 5.2.028 for iOS, consider disabling SSL VPN connections until a patch is available that properly validates certificates.

**Name of the Vulnerable Software and Affected Versions** FortiClient version 5.2.3.091 **Description** The issue concerns the use of a hardcoded encryption key in the qm class, which can be leveraged by attackers to decrypt sensitive data, including passwords, stored in the Shared Preferences. **Recommendations** For FortiClient version 5.2.3.091, consider updating to a newer version that does not use a hardcoded encryption key, or contact the vendor for specific guidance on securing the affected component. As a temporary workaround, restrict access to sensitive data stored in the Shared Preferences to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FortiOS version 5.0 Patch 7 build 4457 **Description** The issue is caused by insufficient protection of the web page structure, allowing remote authenticated users to inject arbitrary web script or HTML via the `WTP Name` or `WTP Active Software Version` field in a CAPWAP Join request. This can enable an attacker to inject arbitrary JavaScript or HTML code. **Recommendations** For FortiOS version 5.0 Patch 7 build 4457, consider disabling the CAPWAP Join request functionality until a patch is available. Restrict access to the WTP Name and WTP Active Software Version fields to minimize the risk of exploitation. Avoid using these fields in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FortiOS version 5.0 Patch 7 build 4457 **Description** The issue is related to errors in handling input data by the Control and Provisioning of Wireless Access Points (CAPWAP) daemon. It allows remote attackers to cause a denial of service, specifically locking the CAPWAP Access Controller, by sending a large number of ClientHello DTLS messages. **Recommendations** For FortiOS version 5.0 Patch 7 build 4457, consider restricting the handling of DTLS messages to prevent the denial of service. As a temporary workaround, limiting the number of ClientHello messages processed by the CAPWAP daemon may help mitigate the risk. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nagios XI versions prior to 2012R2.4 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `tfPassword` parameter to the "nagiosql/index.php" endpoint. **Recommendations** For versions prior to 2012R2.4, update to version 2012R2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "nagiosql/index.php" endpoint to minimize the risk of exploitation. Avoid using the `tfPassword` parameter in the affected endpoint until the issue is resolved.