The Secure Elements Class 5 AVR client fails to enforce integrity of message digests. This may allow an attacker to replay modified messages to a vulnerable client.
Class 5 AVR
Secure Elements Class 5 AVR (Automated Vulnerability Remediation) is a security product that monitors and enforces security policies on network assets. Class 5 AVR is now known as C5 EVM (Enterprise Vulnerability Management). The Class 5 AVR software includes both server and client components.
Class 5 AVR client
The Class 5 AVR client listens on
60000/udp and an additional tcp port. This client receives commands sent by the Class 5 AVR server.
Class 5 AVR server
The Class 5 AVR server is available as an appliance or as software that runs on commodity hardware. The Class 5 AVR server contains information about network assets, vulnerabilities, and remediation history.
The Class 5 AVR client does not enforce the integrity of message digests.
A remote attacker may be able to modify and replay messages to a vulnerable client.
Upgrade or patch
This issue has been resolved in C5 EVM 2.8.1.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Vendor has issued information
__ Sort by: Status Alphabetical
Affected Unknown __ Unaffected
Notified: February 06, 2006 Updated: May 26, 2006
Remediation in C5 EVM version 2.8.1 and above
The C5 EVM Sensor now calculates the digest of incoming messages; rejecting any messages that do not match the digest provided by the sender.
The vendor has not provided us with any further information regarding this vulnerability.
Group | Score | Vector
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | | N/A
Thanks to the NOAA N-CIRT Lab for reporting this vulnerability.
This document was written by Will Dormann.
CVE IDs: | None
Severity Metric:** | 0.35
Date Public: | 2006-05-30
Date First Published: | 2006-05-30
Date Last Updated: | 2006-06-07 02:48 UTC
Document Revision: | 6