UBUNTU-CVE-2022-45142

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches and possibly other branches a logic inversion sneaked...

PT-2022-6537 · Heimdal +4 · Heimdal +4

Name of the Vulnerable Software and Affected Versions: heimdal versions 7.7.1 through 7.8.0 Description: The issue is related to the implementation of the Kerberos5 protocol in heimdal, specifically concerning incorrect validation of message integrity codes. This can allow a remote attacker to...

MGASA-2022-0355 Updated thunderbird packages fix security vulnerability

Improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properlyCVE-2022-39236 Too permissive key forwarding strategy allowing impersonation CVE-2022-39249 Trusting/verifying the user identity under the control of the homeserver instead of the intended one...

CVE-2022-30273

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm TEA block-cipher in ECB mode. This mode of operation does n...

CVE-2022-30273

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm TEA block-cipher in ECB mode. This mode of operation does n...

Code injection

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm TEA block-cipher in ECB mode. This mode of operation does n...

CVE-2022-30273

CVE-2022-30273 affects Motorola Solutions MDLC protocol. The vulnerability stems from Legacy Encryption mode, where TEA is used in ECB, providing no message integrity and reduced confidentiality. Affected product: MDLC protocol parser (versions around 4.x referenced in advisories). Consequences i...

CVE-2022-30273

The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm TEA block-cipher in ECB mode. This mode of operation does n...

CVE-2020-10635 ICSA-20-098-05 KUKA.Sim Pro Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a model, the server transmits the model in plaintext...

The vulnerability of the TCP Normalizer component of the microprogramming software for Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows a attacker to cause a service failure.

The vulnerability of the TCP Normalizer component in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to the lack of integrity checking for messages. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending...

kernel: not verifying TKIP MIC of fragmented frames

A vulnerability was found in Linux kernel's WiFi implementation. An attacker within wireless range can inject a control packet fragment where the kernel does not verify the Message Integrity Check authenticity of fragmented TKIP frames...

The vulnerability of the Java Eclipse Che development environment server, related to the lack of message integrity checking, allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the Java Eclipse Che development environment server is related to the lack of integrity checks for messages. Exploiting this vulnerability allows a remote attacker to perform “man-in-the-middle” attacks...

CVE-2021-37605

In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check MIC bytes...

CVE-2021-37605

In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check MIC bytes...

Design/Logic Flaw

In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check MIC bytes...

Microsoft SharePoint Missing Check of Message Integrity Vulnerability

This vulnerability allows network-adjacent attackers to tamper with update data on affected installations of Microsoft SharePoint. User interaction is required to exploit this vulnerability. The specific flaw exists within the handling of SharePoint Help updates. The issue results from a missing...

(Pwn2Own) Microsoft Exchange Server Missing Check of Message Integrity Vulnerability

This vulnerability allows network-adjacent attackers to tamper with update data on affected installations of Microsoft Exchange Server. User interaction is required to exploit this vulnerability. The specific flaw exists within the handling of Exchange Server Help updates. The issue results from ...

CVE-2020-26141

A vulnerability was found in Linux kernel's WiFi implementation. An attacker within wireless range can inject a control packet fragment where the kernel does not verify the Message Integrity Check authenticity of fragmented TKIP frames. Mitigation Mitigation for this issue is either not available...

CVE-2020-26141

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check authenticity of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the...

Information disclosure

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check authenticity of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the...