Ikki

A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a long control hostname to TCP port 5405.

Name of the Vulnerable Software and Affected Versions: DFLabs PTK versions 0.1 through 1.0 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image. This is due to a problem in the get file type function in lib/file content.php. Recommendations: For DFLabs PTK versions 0.1 through 1.0, consider restricting access to the get file type function in lib/file content.php until a patch is available. As a temporary workaround, avoid using filenames with shell metacharacters after an arg1= sequence in a forensic image.

The issue concerns a back door "service" account with a predefined password, making it easier for remote attackers to gain access.

The issue allows remote authenticated users to read arbitrary files via a .. (dot dot) in a GET request to API endpoints such as `/` or other unspecified endpoints, by manipulating the `file path` variable. This can potentially expose sensitive files, including `save.dat` and `apply.log`, which may contain credentials like the Skype username and password.

A cross-site scripting (XSS) issue exists in the web server component, allowing remote attackers to inject arbitrary web script or HTML via the request URL. This occurs because the web server does not properly handle the request URL in a 404 web error page.

Name of the Vulnerable Software and Affected Versions: Boa version 0.93.15 Description: The issue allows remote attackers to change the admin password stored in memory by sending a long username in an HTTP Basic Authentication request. This is due to the failure of the Intersil isl3893 extensions to prevent stack writes from entering memory locations used for string constants. Recommendations: For Boa version 0.93.15, consider restricting access to the HTTP Basic Authentication endpoint until a fix is available. As a temporary workaround, avoid using the `username` variable in the affected API endpoint, such as "/api/v1/login", to minimize the risk of exploitation.