Ruben Santamarta

O problema está relacionado a um SPI malformado na resposta para o eswifi, o que pode corromper a memória do kernel. É descrito como um estouro de buffer baseado em heap.

The issue concerns an improper algorithm used for PIN codes in the affected satellite terminals, making it easier for attackers to calculate the superuser code. This could allow attackers to obtain a privileged terminal session by leveraging physical access or terminal access to enter the calculated code.

The issue allows remote attackers to execute arbitrary code by uploading new firmware to the TCP port 54321. This is related to the Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations.

The issue allows remote attackers to read hardcoded credentials via the web interface on the Pilot Below Deck Equipment (BDE) and OpenPort implementations.

The issue concerns hardcoded credentials for the administrator account in the affected satellite terminals. This allows attackers to gain administrative control by leveraging physical access or terminal access.

The issue concerns hardcoded Tbus 2 credentials in Cobham Sailor 6000 satellite terminals. This allows remote attackers to obtain access via a TBUS2 command. The vendor has stated that there is no possibility to exploit another user's credentials.

The issue allows attackers to obtain administrative privileges by leveraging physical access or terminal access to spoof a reset code, due to improper restriction of password recovery.

The issue concerns the thraneLINK protocol implementation, which fails to verify firmware signatures. This allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response.

The issue allows remote attackers to execute arbitrary code via unspecified protocol operations on TCP port 1827, due to the lack of authentication for sessions.

The issue concerns hardcoded credentials in the firmware of various satellite terminals, making it easier for attackers to gain unspecified login access.

Name of the Vulnerable Software and Affected Versions: SafeNet SoftRemote versions prior to 10.8.6 Description: The issue is a stack-based buffer overflow in the IKE service, allowing remote attackers to execute arbitrary code via a long request to UDP port 62514. Recommendations: For versions prior to 10.8.6, update to version 10.8.6 or later to resolve the issue.

The issue allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe and sending RPC messages that trigger a dereference of an arbitrary pointer.

The issue arises from improper validation of input sent from user mode to the kernel in the Ancillary Function Driver (AFD) component. This allows local users to gain privileges via a crafted application, potentially enabling an attacker to run code with elevated privileges and execute arbitrary code, thereby taking complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

Name of the Vulnerable Software and Affected Versions: RealWin Server version 2.0 Description: A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a crafted FC INFOTAG/SET CONTROL packet. Recommendations: For RealWin Server version 2.0, consider applying a patch or fix to address the stack-based buffer overflow issue, if available. As a temporary workaround, restrict access to the FC INFOTAG/SET CONTROL packet handling functionality to minimize the risk of exploitation.

The issue is caused by an integer overflow in the IopfCompleteRequest API in the kernel, allowing context-dependent attackers to gain privileges. This can be exploited locally via repeated IoAttachDevice IOCTL calls to the `.GEARAspiWDMDevice` in the GEARAspiWDM.sys driver. The estimated number of potentially affected devices and details about real-world incidents are not provided.

The issue allows remote attackers to execute arbitrary code via a specially crafted PowerPoint file, potentially leading to memory corruption. This can be exploited by creating a malicious PowerPoint file that could be sent as an email attachment or hosted on a compromised website. If successfully exploited, an attacker could gain complete control of the affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. The impact may be less severe for users with limited user rights.

The issue is related to a heap-based buffer overflow in the quickTime.qts component, which can be triggered by a crafted PICT image file with Kodak encoding. This is due to inadequate error checking and error messages. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Name of the Vulnerable Software and Affected Versions: Apple QuickTime versions prior to 7.3 Description: The issue is related to a heap-based buffer overflow that occurs when parsing certain elements in a PICT image, specifically the Poly type and PackBitsRgn field opcodes. This can allow remote attackers to execute arbitrary code. Recommendations: For Apple QuickTime versions prior to 7.3, update to version 7.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Apple QuickTime versions prior to 7.3 Description: The issue is related to a heap-based buffer overflow that occurs when parsing the color table atom (CTAB) in a movie file. This happens due to an invalid color table size, specifically related to the CTAB RGB values, allowing remote attackers to execute arbitrary code. Recommendations: For versions prior to 7.3, update to version 7.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Apple QuickTime versions prior to 7.3 Description: The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by using an invalid UncompressedQuickTimeData opcode length in a PICT image. Recommendations: For versions prior to 7.3, update to version 7.3 or later to resolve the issue.