SB2022011002 - Multiple vulnerabilities in Garrett Metal Detectors iC Module CMA
Published: January 10, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2021-21903)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing UDP packets in the check_udp_crc() function of the CMA Connect software for Garrett PD 6500i and Garrett MZ 6100 models. A remote attacker can specially crafted packets to port 6877/UDP, trigger stack-based buffer overflow and execute arbitrary code on the target system.
2) Path traversal (CVE-ID: CVE-2021-21907)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in the CMA CLI getenv command functionality. A remote administrator can send a specially crafted HTTP request and read arbitrary files on the system.
3) Path traversal (CVE-ID: CVE-2021-21909)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in in the del .cnt|.log file delete command. A remote administrator can send a specially crafted HTTP request and delete arbitrary files on the system.
4) Path traversal (CVE-ID: CVE-2021-21908)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in "file" parameter in the handle_delete function. A remote administrator can send a specially crafted HTTP request and delete arbitrary files on the system.
5) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2021-21902)
The vulnerability allows a remote attacker to to bypass authentication process.
The vulnerability exists due to incorrect implementation of authentication algorithm in the CMA run_server_6877 functionality. A remote attacker can send a specially crafted request and bypass the authentication.
6) Buffer overflow (CVE-ID: CVE-2021-21901)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the CMA check_udp_crc function. A remote attacker can send a specially crafted packet, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Stack-based buffer overflow (CVE-ID: CVE-2021-21906)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the "checkPassword" CMA readfile function. A remote administrator can use a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
8) Stack-based buffer overflow (CVE-ID: CVE-2021-21905)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the "get_ip" CMA readfile function. A remote administrator can use a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Path traversal (CVE-ID: CVE-2021-21904)
The vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing CLI setenv command arguments. A local user can run a specially crafted command to overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1355
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1358
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1359
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1354
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1353
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1357
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1356