198 matches found
Unspecified Vulnerability in Oracle Java SE and Java SE Embedded (CNVD-2019-26735)
Oracle Java SE is the standard version of Oracle's Java platform for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments, and Java SE and Java SE Embedded are components of Java SE Embedded, a Java platform for developing powerful,...
Wind River VxWorks Vulnerabilities
Overview A security researcher has identified two vulnerabilities affecting the Wind River Systems’ VxWorks platform. The vulnerabilities are a debug service enabled by default VU362332 and a weak hashing algorithm used in authentication VU840249. ICS-CERT has been coordinating with CERT/CC in...
Modern OSs for embedded systems
At Kaspersky Lab we analyze the technologies available on cybersecurity market and this time we decided to look at what OS developers are offering for embedded systems or, in other words, the internet of things. Our primary interest is how and to what degree these OSs can solve...
PolarSSL: Multiple vulnerabilities
Background PolarSSL is a cryptographic library for embedded systems. Description Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details. Impact A remote attacker might be able to execute arbitrary code, cause Denial of Service...
picoTCP Stack Buffer Overflow Vulnerability
picoTCP is a modular open source TCP/IP stack designed for embedded systems and IoT. A stack buffer overflow vulnerability exists in picoTCP versions 1.7.0 through 1.5.0. A remote attacker could exploit this vulnerability to execute code or cause a denial of service...
Kaspersky Embedded Systems Security Buffer Overflow Vulnerability
Kaspersky Embedded Systems Security is a security protection software for embedded systems developed by the Russian Kaspersky Lab. A buffer overflow vulnerability exists in the driver in Kaspersky Embedded Systems Security versions 1.2.0.300 and 2.0.0.385. The vulnerability can be exploited by an...
CVE-2017-12823
Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation...
Memory corruption
Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation...
CVE-2017-12823
Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation...
CVE-2017-12823
Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation...
CVE-2017-12823
CVE-2017-12823 affects Kaspersky Embedded Systems Security (ESES); a kernel pool memory corruption in a driver leads to local privilege escalation. Connected sources indicate vulnerable versions include 1.2.0.300 (and 2.0.0.385 per CNVD). The root cause is memory corruption/buffer overflow in the...
Cesanta Mongoose MQTT Payload Length Remote Code Execution(CVE-2017-2892)
Summary An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and...
REMOTE CODE EXECUTION (CVE-2017-13772) WALKTHROUGH ON A TP-LINK ROUTER
INTRODUCTION In this post, I will be discussing my recent findings while conducting vulnerability research on a home router: TP-Link’s WR940N home WiFi router. This post will outline the steps taken to identify vulnerable code paths, and how we can exploit those paths to gain remote code executio...
PT-2017-18006 · Nxp · Nxp I.Mx 7Dual +16
Name of the Vulnerable Software and Affected Versions: NXP i.MX 28 NXP i.MX 50 NXP i.MX 53 NXP i.MX 7Solo NXP i.MX 7Dual NXP Vybrid VF3xx NXP Vybrid VF5xx NXP Vybrid VF6xx NXP i.MX 6ULL NXP i.MX 6UltraLite NXP i.MX 6SoloLite NXP i.MX 6Solo NXP i.MX 6DualLite NXP i.MX 6SoloX NXP i.MX 6Dual NXP i.M...
Vulnerabilities in Car Washes
Articles about serious vulnerabilities in IoT devices and embedded systems are now dime-a-dozen. This one concerns Internet-connected car washes: A group of security researchers have found vulnerabilities in internet-connected drive-through car washes that would let hackers remotely hijack the...
Vulnerability Spotlight: Multiple Vulnerabilities in InsideSecure MatrixSSL
These vulnerabilities were discovered by Aleksandar Nikolic of Cisco TalosOverviewMatrixSSL is a TLS/SSL stack offered in the form of a Software Development Kit SDK that is geared towards application in Internet of Things IOT devices and other embedded systems. It features low resource overhead a...
InsideSecure MatrixSSL x509 certificate IssuerDomainPolicy Remote Code Execution Vulnerability
Summary An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a...
Is Continuing to Patch Windows XP a Mistake?
Last week, Microsoft issued a security patch for Windows XP, a 16-year-old operating system that Microsoft officially no longer supports. Last month, Microsoft issued a Windows XP patch for the vulnerability used in WannaCry. Is this a good idea? This 2014 essay argues that it's not: The zero-day...
[SECURITY] Fedora 25 Update: picocom-2.2-2.fc25
As its name suggests, picocom is a minimal dumb-terminal emulation program. It is, in principle, very much like minicom, only it's "pico" instead of "mini"! It was designed to serve as a simple, manual, modem configuration, testing, and debugging tool. It has also served quite well as a low-tech...