Eric Sesterhenn

**Name of the Vulnerable Software and Affected Versions** ntpd-rs versions 1.2.0 through 1.6.1 **Description** ntpd-rs, a tool for synchronizing a computer's clock implementing the NTP and NTS protocols, contains a denial of service issue. When configured as a server, the software incorrectly responds to all NTP messages, including those from other servers. This can lead to a message storm between two ntpd-rs servers, consuming significant resources. Client-only configurations are not affected. **Recommendations** Upgrade to version 1.6.2 as soon as possible. If upgrading is not possible, mitigate the issue by whitelisting access to only client IP addresses using the ignore filter method. Block incoming non-request traffic on the NTP server port using a firewall. Disable public access to the vulnerable NTP server. Disable the server functionality by removing any [server] sections from the configuration.

**Name of the Vulnerable Software and Affected Versions** Gemalto (affected versions not specified) **Description** A potential stack-based buffer overflow issue existed in the GemaltoKeyHandle.cpp file. This issue was fixed in SCSSU-201801. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Git versions prior to 2.30.7 **Description** The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both. **Recommendations** For Git versions prior to 2.30.7, upgrade to a version published on or after 2023-01-17 to resolve the issue. As a temporary workaround, consider restricting the use of the `.gitattributes` file until a patch is applied. Avoid using huge numbers of path patterns, attributes for a single pattern, or huge declared attribute names in the `.gitattributes` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Psyprax versions prior to 3.2.2 **Description** An issue was discovered where the file %PROGRAMDATA%Psyprax32PPScreen.ini contains a hash for the lockscreen of the application. If this entry is removed, the lockscreen is no longer displayed and the app is no longer locked. All local users are able to modify this file. **Recommendations** For versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the %PROGRAMDATA%Psyprax32PPScreen.ini file to prevent local users from modifying it.

**Name of the Vulnerable Software and Affected Versions** New Media Smarty versions prior to 9.10 **Description** An issue was discovered where passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. **Recommendations** For versions prior to 9.10, update to version 9.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the data.mdb file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Epikur versions prior to 20.1.1 **Description** An issue was discovered in the Epikur server, where the `checkPasswort()` function checks the submitted password against the user password's MD5 hash stored in the database and a second MD5 hash, which is the same for every user, known as a "Backdoor Password" of `3p1kursupport`. If the submitted password matches either one, access is granted. **Recommendations** For versions prior to 20.1.1, update to version 20.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the `checkPasswort()` function until a patch is available. Restrict access to the login functionality to minimize the risk of exploitation. Avoid using the backdoor password `3p1kursupport` in the affected system until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** HylaFAX version 6.0.6 HylaFAX+ version 5.6.0 **Description** The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file. **Recommendations** For HylaFAX version 6.0.6, consider disabling the `FaxModem::writeECMData()` function until a patch is available. For HylaFAX+ version 5.6.0, restrict access to the faxd/CopyQuality.c++ file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** An issue in the fax notify mail function in faxrec.c allows for a buffer overflow due to the `mail to` parameter not being sanitized. This could potentially lead to a denial of service if long untrusted input reaches it. The exploitation of this issue may cause a stack-based buffer overflow, allowing an attacker to disrupt service using the `mail to` parameter. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting input to the `fax notify mail` function to prevent long untrusted input from reaching the `mail to` parameter.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** A stack-based buffer overflow issue can be triggered via a command-line parameter in the contrib/scrts.c file. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** An issue was discovered in the contrib/next-login/login.c file, where the command-line parameter `username` is passed unsanitized to the strcpy() function, which can cause a stack-based buffer overflow. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation. Avoid using the `username` parameter in the affected login functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** mgetty versions prior to 1.2.1 **Description** An issue was discovered where the `mail to` parameter in the `fax notify mail()` function is not sanitized, potentially allowing for command injection if untrusted input can reach it due to the use of `popen`. **Recommendations** For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `fax notify mail()` function to minimize the risk of exploitation. Avoid using untrusted input for the `mail to` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue arises from endless recursion when handling responses from an IAS-ECC card in the iasecc select file function in libopensc/card-iasecc.c. This could be exploited by attackers who can supply crafted smartcards, potentially causing the opensc library to hang or crash when used by programs. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue concerns out of bounds reads when handling responses in OpenSC. Attackers who can supply crafted smartcards may potentially crash the opensc library using programs. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** A double free issue when handling responses from a smartcard in the sc file set sec attr function in libopensc/sc.c could be used by attackers to cause a denial of service, potentially leading to an application crash, or possibly having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from an ePass 2003 Card in the `decrypt response` function in `libopensc/card-epass2003.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from a Cryptoflex card in the `read public key` function in `tools/cryptoflex-tool.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `read public key` function in `tools/cryptoflex-tool.c` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** A buffer overflow issue exists when handling string concatenation in the `util acl to str` function in `tools/util.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from a CAC Card in the `cac get serial nr from CUID` function in `libopensc/card-cac.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** A double free issue exists when handling responses in the read file function in tools/egk-tool.c, which could allow attackers to cause a denial of service or possibly have other unspecified impacts by supplying crafted smartcards. **Recommendations** For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSC versions prior to 0.19.0-rc1 **Description** The issue is related to several buffer overflows that occur when handling responses from a Gemsafe V1 Smartcard in the `gemsafe get cert len` function in `libopensc/pkcs15-gemsafeV1.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts. **Recommendations** For OpenSC versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue.