Özcan Ersan

Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus Package Installer: from 0.7.0 before 0.7.1.

A Time-of-check time-of-use (TOCTOU) race condition exists in Pardus MyComputer. A TOCTOU race condition is a software bug where a program checks the state of a resource (such as a file) and then performs an action based on that check, but the state of the resource changes between the check and the use.

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.

An observable response discrepancy allows account footprinting, which enables username enumeration. This occurs when the application provides different responses based on whether a username exists in the system.

A stack-based buffer overflow exists in the login handler of the '/bin/netis.cgi' endpoint. The issue occurs because the custom Base64 decoder fails to validate the output length against a fixed-size stack buffer when processing an oversized Base64-encoded password provided via the `password` parameter. Since the Boa web server executes the CGI environment with root privileges, an unauthenticated remote attacker can overwrite the saved stack state to achieve remote code execution as root.

An issue exists where unauthenticated remote attackers can overwrite the saved stack state by providing an oversized `destHost` parameter to the `ipFilterList=mod` action in the 'netis.cgi' endpoint. This occurs because of widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified. Since the Boa web server executes the CGI environment with root privileges, this can lead to remote code execution as root.

An authentication enforcement flaw in the Boa web server and `netis.cgi` CGI dispatcher allows unauthenticated attackers to upload unsigned firmware images. The Boa web server grants access to any path containing `.cgi` without requiring a valid session cookie, and the `netis.cgi` dispatcher fails to enforce the authentication state before triggering the firmware update handler. The system validates firmware images using static product strings and a forgeable additive checksum instead of a cryptographic signature, which could lead to persistent compromise of the router. This is exploited by sending a multipart POST request to the '/cgi-bin/upload fw.cgi' endpoint.