Joaquin Rodriguez Varela

**Name of the Vulnerable Software and Affected Versions** AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera version FW AIC1620W 1.1.0-12 20120709 r1192.pck **Description** The issue allows remote authenticated users to execute arbitrary OS commands. This is achieved by injecting shell metacharacters in the `mac` parameter of the snwrite.cgi endpoint. **Recommendations** For AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera version FW AIC1620W 1.1.0-12 20120709 r1192.pck, consider restricting access to the snwrite.cgi endpoint until a patch is available. As a temporary workaround, avoid using the `mac` parameter in the snwrite.cgi endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AirLive BU-2015 version 1.03.18 AirLive BU-3026 version 1.43 AirLive MD-3025 version 1.81 **Description** The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the `write mac`, `write pid`, `write msn`, `write tan`, or `write hdv` parameter. This is due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the issue may allow a remote attacker to execute arbitrary OS commands using shell metacharacters. **Recommendations** For AirLive BU-2015 version 1.03.18, consider disabling the `cgi test.cgi` script until a patch is available. For AirLive BU-3026 version 1.43, restrict access to the `write mac`, `write pid`, `write msn`, `write tan`, and `write hdv` parameters in the `cgi test.cgi` script to minimize the risk of exploitation. For AirLive MD-3025 version 1.81, avoid using the `write mac`, `write pid`, `write msn`, `write tan`, and `write hdv` parameters in the `cgi test.cgi` script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions 9.3 before p39 FreeBSD versions 10.1 before p31 FreeBSD versions 10.2 before p14 **Description** The issue is caused by an integer signedness error in the `amd64 set ldt` function, located in `sys/amd64/amd64/sys machdep.c`, which leads to a heap-based buffer overflow. This can be exploited by a local attacker using the `i386 set ldt` system call, resulting in a denial of service (kernel panic). **Recommendations** For FreeBSD version 9.3, update to p39 or later. For FreeBSD version 10.1, update to p31 or later. For FreeBSD version 10.2, update to p14 or later.