Ege Balci

توجد مشكلة عند تحليل صور PNG مصممة خصيصاً تحتوي على بيانات وصفية لملف تعريف ألوان مشوهة. يفشل التطبيق في التحقق من حدود الـ chunk أثناء البحث عن محدد نهائي فارغ (null terminator)، مما قد يؤدي إلى قراءة التطبيق لما يتجاوز المخزن المؤقت المخصص إذا قام المستخدم بفتح صورة خبيثة. يمكن أن يؤدي ذلك إلى حجب الخدمة (DoS) من خلال تعطل التطبيق أو احتمال كشف محتويات الذاكرة الحساسة.

The web-management application on the affected devices allows OS command injection via `mv backend launch` in `cirrus/application/helpers/mv backend helper.php` by leveraging the "start" state and sending a `check device name` request.

An issue in rsync allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories, for example, overwrite the .ssh/authorized keys file.

The issue concerns broken access control in the devices, allowing attackers to download sensitive files without authentication. Specifically, attackers can access `/updownload/t.report` (also known as Log & Report) files and backup files via `download.php`. These backup files contain user credentials and configuration information for the camera device. An attacker can discover the backup filename by reading system logs or report data, or by brute-forcing the backup filename pattern. This could potentially allow an attacker to authenticate to the admin account using the admin password.

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this issue to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.