Tuomo Untinen

Um único quadro IEEE 802.15.4 (Zigbee) malformado pode fazer com que o gateway TRÅDFRI deixe de responder. Isso faz com que a iluminação conectada não possa ser controlada pelo aplicativo IKEA Home Smart e pelo controle remoto TRÅDFRI. O problema é causado por uma mensagem de transmissão não autenticada, afetando todos os dispositivos vulneráveis dentro do alcance do sinal de rádio.

O problema ocorre quando um invasor envia um único quadro IEEE 802.15.4 (Zigbee) malformado, fazendo com que a lâmpada TRÅDFRI pisque. Se o mesmo quadro for repetido várias vezes, a lâmpada realiza uma redefinição de fábrica, resultando na perda das informações de configuração sobre a rede Zigbee e do nível de brilho atual. Após esse ataque, todas as luzes ficam acesas com brilho total, e o usuário não consegue controlar as lâmpadas nem pelo aplicativo IKEA Home Smart nem pelo controle remoto TRÅDFRI. O quadro Zigbee malformado é uma mensagem de transmissão não autenticada, o que significa que todos os dispositivos vulneráveis dentro do alcance de rádio são afetados.

An issue was discovered where a partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption. The vulnerability is related to an incorrectly implemented authentication mechanism in the WPA algorithm of the D-Link DIR-850L firmware. Exploitation of the vulnerability may allow an attacker to bypass security restrictions by sending specially crafted packets.

The issue allows remote attackers to cause a denial of service due to a NULL pointer dereference via an invalid IPv6 jumbogram.

The issue is related to multiple vulnerabilities in the Quagga package, which can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely. A heap-based buffer overflow in the `ecommunity ecom2str` function in `bgp ecommunity.c` in `bgpd` in Quagga before version 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4.

The issue affects the Quagga package in various Linux operating systems, including Red Hat Enterprise Linux, CentOS, SUSE Linux Enterprise, and openSUSE. It allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message. The `ospf flood` function in `ospf flood.c` in `ospfd` is vulnerable. This can lead to disruption of confidentiality, integrity, and availability of protected information.

The issue allows remote attackers to cause a denial of service via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message. This is due to the `ospf6 lsa is changed` function in `ospf6 lsa.c` in the OSPFv3 implementation in `ospf6d`. The vulnerability can lead to disruption of confidentiality, integrity, and availability of protected information.

The issue affects the Quagga package, allowing remote attackers to cause a denial of service via a Link State Update message with an invalid IPv6 prefix length. This can lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.