Eric Sesterhenn

ntpd-rs, a tool for synchronizing a computer's clock implementing the NTP and NTS protocols, contains a denial of service issue. When configured as a server, the software incorrectly responds to all NTP messages, including those from other servers. This can lead to a message storm between two ntpd-rs servers, consuming significant resources. Client-only configurations are not affected.

Existia uma possível vulnerabilidade de estouro de buffer na pilha no arquivo GemaltoKeyHandle.cpp. Este problema foi corrigido em SCSSU-201801.

The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both.

Foi detectada uma falha em que o arquivo %PROGRAMDATA%Psyprax32PPScreen.ini contém um hash para a tela de bloqueio do aplicativo. Se essa entrada for removida, a tela de bloqueio deixa de ser exibida e o aplicativo não fica mais bloqueado. Todos os usuários locais podem modificar esse arquivo.

Foi detectada uma falha em que as senhas são armazenadas no banco de dados em um formato ofuscado que pode ser facilmente revertido. O arquivo data.mdb contém essas senhas ofuscadas na segunda coluna.

Foi descoberta uma falha no servidor Epikur, na qual a função `checkPasswort()` compara a senha enviada com o hash MD5 da senha do usuário armazenado no banco de dados e com um segundo hash MD5, que é o mesmo para todos os usuários, conhecido como “senha backdoor” de `3p1kursupport`. Se a senha enviada corresponder a qualquer um deles, o acesso é concedido.

The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file.

An issue in the fax notify mail function in faxrec.c allows for a buffer overflow due to the `mail to` parameter not being sanitized. This could potentially lead to a denial of service if long untrusted input reaches it. The exploitation of this issue may cause a stack-based buffer overflow, allowing an attacker to disrupt service using the `mail to` parameter.

A stack-based buffer overflow issue can be triggered via a command-line parameter in the contrib/scrts.c file.

An issue was discovered in the contrib/next-login/login.c file, where the command-line parameter `username` is passed unsanitized to the strcpy() function, which can cause a stack-based buffer overflow.

An issue was discovered where the `mail to` parameter in the `fax notify mail()` function is not sanitized, potentially allowing for command injection if untrusted input can reach it due to the use of `popen`.

The issue arises from endless recursion when handling responses from an IAS-ECC card in the iasecc select file function in libopensc/card-iasecc.c. This could be exploited by attackers who can supply crafted smartcards, potentially causing the opensc library to hang or crash when used by programs.

The issue concerns out of bounds reads when handling responses in OpenSC. Attackers who can supply crafted smartcards may potentially crash the opensc library using programs.

A double free issue when handling responses from a smartcard in the sc file set sec attr function in libopensc/sc.c could be used by attackers to cause a denial of service, potentially leading to an application crash, or possibly having other unspecified impacts.

The issue is related to several buffer overflows that occur when handling responses from an ePass 2003 Card in the `decrypt response` function in `libopensc/card-epass2003.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts.

The issue is related to several buffer overflows that occur when handling responses from a Cryptoflex card in the `read public key` function in `tools/cryptoflex-tool.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts.

A buffer overflow issue exists when handling string concatenation in the `util acl to str` function in `tools/util.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts.

The issue is related to several buffer overflows that occur when handling responses from a CAC Card in the `cac get serial nr from CUID` function in `libopensc/card-cac.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts.

A double free issue exists when handling responses in the read file function in tools/egk-tool.c, which could allow attackers to cause a denial of service or possibly have other unspecified impacts by supplying crafted smartcards.

The issue is related to several buffer overflows that occur when handling responses from a Gemsafe V1 Smartcard in the `gemsafe get cert len` function in `libopensc/pkcs15-gemsafeV1.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts.