PT-2017-7050 · Msa · Msa Vot.Ar

Published 2017-10-23 · Updated 2017-11-17 · CVE-2015-6839

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MSA vot.Ar version 3.1

Description The issue concerns the parse function not checking for multiple votes for a candidate, allowing physically proximate attackers to cast multiple votes via a crafted RFID ballot tag.

Recommendations For MSA vot.Ar version 3.1, consider implementing a check to prevent a candidate from receiving more than one vote to mitigate the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-6839

Affected Products

Msa Vot.Ar

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-6839 · Security Note
• https://docs.google.com/document/d/1aH6kvoLR8O1qWOpEz89FAB2xFcBNB-QqHgZpXxg0vGE/preview?sle=true&pli=1 · Note
• https://youtube.com/watch?v=CTOCspLn6Zk · Note
• https://docs.google.com/document/d/13t1jqu-Upj4SyjYBMj3OMshdy6rGBrnb1R3P-goz-cs/edit?pli=1 · Note
• https://eleccionesciudad.gob.ar/uploads/resoluciones/Informe_05-BALOTAJE-2015-07-17.pdf · Note