Eric Sesterhenn

ntpd-rs, a tool for synchronizing a computer's clock implementing the NTP and NTS protocols, contains a denial of service issue. When configured as a server, the software incorrectly responds to all NTP messages, including those from other servers. This can lead to a message storm between two ntpd-rs servers, consuming significant resources. Client-only configurations are not affected.

A potential stack-based buffer overflow issue existed in the GemaltoKeyHandle.cpp file. This issue was fixed in SCSSU-201801.

The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both.

An issue was discovered where the file %PROGRAMDATA%Psyprax32PPScreen.ini contains a hash for the lockscreen of the application. If this entry is removed, the lockscreen is no longer displayed and the app is no longer locked. All local users are able to modify this file.

An issue was discovered where passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column.

An issue was discovered in the Epikur server, where the `checkPasswort()` function checks the submitted password against the user password's MD5 hash stored in the database and a second MD5 hash, which is the same for every user, known as a "Backdoor Password" of `3p1kursupport`. If the submitted password matches either one, access is granted.

The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file.

An issue in the fax notify mail function in faxrec.c allows for a buffer overflow due to the `mail to` parameter not being sanitized. This could potentially lead to a denial of service if long untrusted input reaches it. The exploitation of this issue may cause a stack-based buffer overflow, allowing an attacker to disrupt service using the `mail to` parameter.

A stack-based buffer overflow issue can be triggered via a command-line parameter in the contrib/scrts.c file.

An issue was discovered in the contrib/next-login/login.c file, where the command-line parameter `username` is passed unsanitized to the strcpy() function, which can cause a stack-based buffer overflow.

An issue was discovered where the `mail to` parameter in the `fax notify mail()` function is not sanitized, potentially allowing for command injection if untrusted input can reach it due to the use of `popen`.

The issue arises from endless recursion when handling responses from an IAS-ECC card in the iasecc select file function in libopensc/card-iasecc.c. This could be exploited by attackers who can supply crafted smartcards, potentially causing the opensc library to hang or crash when used by programs.

The issue concerns out of bounds reads when handling responses in OpenSC. Attackers who can supply crafted smartcards may potentially crash the opensc library using programs.

A double free issue when handling responses from a smartcard in the sc file set sec attr function in libopensc/sc.c could be used by attackers to cause a denial of service, potentially leading to an application crash, or possibly having other unspecified impacts.

The issue is related to several buffer overflows that occur when handling responses from an ePass 2003 Card in the `decrypt response` function in `libopensc/card-epass2003.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts.

The issue is related to several buffer overflows that occur when handling responses from a Cryptoflex card in the `read public key` function in `tools/cryptoflex-tool.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts.

A buffer overflow issue exists when handling string concatenation in the `util acl to str` function in `tools/util.c`. This could be exploited by attackers who can supply crafted smartcards, potentially causing a denial of service (application crash) or having other unspecified impacts.

The issue is related to several buffer overflows that occur when handling responses from a CAC Card in the `cac get serial nr from CUID` function in `libopensc/card-cac.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts.

A double free issue exists when handling responses in the read file function in tools/egk-tool.c, which could allow attackers to cause a denial of service or possibly have other unspecified impacts by supplying crafted smartcards.

The issue is related to several buffer overflows that occur when handling responses from a Gemsafe V1 Smartcard in the `gemsafe get cert len` function in `libopensc/pkcs15-gemsafeV1.c`. This could be exploited by attackers who can supply crafted smartcards, potentially leading to a denial of service (application crash) or other unspecified impacts.