A week in security (September 23 – 29)

Last week on Labs, we highlighted an Emotet campaign using Snowden’s new book as a lure, discussed how 15,000 webcams are vulnerable to attack, how insurance data security laws skirt political turmoil, and how the new iOS exploit checkm8 allows permanent compromise of iPhones. Other cybersecurity...

Congress Grills the Spy Chief, Google’s Quantum 'Victory,' and More News

Catch up on the most important news from today in two minutes or less...

Schneider Electric Quantum 140 NOE771x1 Code Issue Vulnerability

The Schneider Electric Quantum 140 NOE771x1 is an Ethernet module from Schneider Electric France. A code issue vulnerability exists in Schneider Electric Quantum 140 NOE771x1 version 6.9 and prior. The vulnerability stems from an improperly designed or implemented code development process for a...

CVE-2019-6828

A CWE-248: Uncaught Exception vulnerability exists Modicon M580 firmware version prior to V2.90, Modicon M340 firmware version prior to V3.10, Modicon Premium all versions, and Modicon Quantum all versions, which could cause a possible denial of service when reading specific coils and registers i...

CVE-2019-6809

A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 firmware versions prior to V2.90, Modicon M340 firmware versions prior to V3.10, Modicon Premium all versions, Modicon Quantum all versions, which could cause a possible denial of service when reading invalid data from the...

CVE-2019-6811

An Improper Check for Unusual or Exceptional Conditions CWE-754 vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a pow...

CVE-2019-6809

A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 firmware versions prior to V2.90, Modicon M340 firmware versions prior to V3.10, Modicon Premium all versions, Modicon Quantum all versions, which could cause a possible denial of service when reading invalid data from the...

CVE-2019-6811

An Improper Check for Unusual or Exceptional Conditions CWE-754 vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a pow...

Input validation

An Improper Check for Unusual or Exceptional Conditions CWE-754 vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a pow...

Design/Logic Flaw

A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 firmware versions prior to V2.90, Modicon M340 firmware versions prior to V3.10, Modicon Premium all versions, Modicon Quantum all versions, which could cause a possible denial of service when reading invalid data from the...

CVE-2019-6828

A CWE-248: Uncaught Exception vulnerability exists Modicon M580 firmware version prior to V2.90, Modicon M340 firmware version prior to V3.10, Modicon Premium all versions, and Modicon Quantum all versions, which could cause a possible denial of service when reading specific coils and registers i...

CVE-2019-6828

CVE-2019-6828 describes an unhandled exception vulnerability (CWE-248) in Schneider Electric Modicon controllers that could cause a denial of service when reading coils and registers over Modbus. Affected products include Modicon M580 (firmware version before v2.90), Modicon M340 (before v3.10), ...

CVE-2019-6811

An Improper Check for Unusual or Exceptional Conditions CWE-754 vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a pow...

CVE-2019-6811

Affected product: Schneider Electric Modicon Quantum 140 NOE771x1 (version 6.9 and earlier). Root cause: Improper check for unusual or exceptional conditions (CWE-754) when handling IP fragmented packets. Impact: Denial of service; module may require a power cycle to recover. Evidence in connecte...

CVE-2019-6809

The CVE affects Schneider Electric Modicon PLCs: M580 (firmware before V2.90), M340 (before V3.10), Premium (all), and Quantum (all). Root cause is CWE-248 Uncaught Exception leading to denial of service when handling invalid data/commands via Modbus/UMAS. Public details in TALOS describe an expl...

PT-2019-6017 · Schneider Electric · Modicon Quantum 140 Noe771X1

Name of the Vulnerable Software and Affected Versions: Modicon Quantum 140 NOE771x1 versions 6.9 and earlier Description: The issue is related to an Improper Check for Unusual or Exceptional Conditions, which could cause denial of service when the module receives an IP fragmented packet with a...

The Doghouse: Crown Sterling

A decade ago, the Doghouse was a regular feature in both my email newsletter Crypto-Gram and my blog. In it, I would call out particularly egregious -- and amusing -- examples of cryptographic "snake oil." I dropped it both because it stopped being fun and because almost everyone converged on...

libmspack: Out-of-bounds write in mspack/cab.h

In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...

SIAM Conference on Applied Algebraic Geometry 2019 - Isogenies mini-symposium

So here we are in the nice city of Bern, in the Teutonic Switzerland, for SIAM Conference on Applied Algebraic Geometry 2019 that this year counts more than 750 attendees! The weather is warm enough but the isogenies topic has never been so hot! So for this occurrence of the conference Tanja Lang...

Presidential Candidate Andrew Yang Has Quantum Encryption Policy

At least one presidential candidate has a policy about quantum computing and encryption. It has two basic planks. One: fund quantum-resistant encryption standards. Note: NIST is already doing this. Two, fund quantum computing. Unlike many far more pressing computer security problems, the market...