Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120 Access Control Error Vulnerability

The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 is a portable cardiac rhythm management Crm programming system from Boston Scientific, Inc. The Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor PRM Model 3120 is vulnerable to an access control error that...

Scientific Linux Security Update : binutils on SL7.x i686/x86_64 (2021:4033)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:4033-1 advisory. - Developer environment: Unicode's bidirectional BiDi override characters can cause trojan source attacks CVE-2021-42574 Note that Nessus has not tested f...

Scientific Linux Security Update : flatpak on SL7.x x86_64 (2021:4044)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:4044-1 advisory. - flatpak: Sandbox bypass via recent VFS-manipulating syscalls CVE-2021-41133 Note that Nessus has not tested for this issue but has instead relied only o...

Scientific Linux Security Update : xstream on SL7.x (noarch) (2021:3956)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3956-1 advisory. - xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl CVE-2021-39139, CVE-2021-39153 - xstream:...

Friday Squid Blogging: Squid Eating Maine Shrimp

Squid are eating Maine shrimp, causing a collapse of the ecosystem. This seems to be a result of climate change. Maines shrimp fishery has been closed for nearly a decade since the stocks collapse in 2013. Scientists are now saying a species of squid that came into the Gulf of Maine during a...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2021:3892)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3892-1 advisory. - OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 - OpenJDK: Incorrect principal selection when usin...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x i686/x86_64 (2021:3889)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3889-1 advisory. - OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 - OpenJDK: Incorrect principal selection when usin...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2021:3791)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3791-1 advisory. - Mozilla: Use-after-free in MessageTask CVE-2021-38496 - Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91....

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2021:3841)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3841-1 advisory. - Mozilla: Use-after-free in MessageTask CVE-2021-38496 - Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91....

Scientific Linux Security Update : libxml2 on SL7.x i686/x86_64 (2021:3810)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3810-1 advisory. - libxml2: Use after free via namespace node in XPointer ranges CVE-2016-4658 Note that Nessus has not tested for this issue but has instead relied only o...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2021:3801)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3801-1 advisory. - kernel: Improper handling of VMIO|VMPFNMAP vmas in KVM can bypass RO checks CVE-2021-22543 - kernel: powerpc: KVM guest OS users can cause host...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (2021:3807)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3807-1 advisory. - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed CVE-2021-3652 Note that Nessus has not tested for this issue but has...

CVE-2021-38400

An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password...

CVE-2021-38400 Use of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom Latitude

An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password...

CVE-2021-38400

CVE-2021-38400 affects Boston Scientific ZOOM LATITUDE Programmer/Recorder/Monitor (PRM) Model 3120. Vulnerability: password hash stored/used with insufficient computational effort, allowing a physically proximate attacker with access to remove the device’s hard drive or craft a USB to extract th...

CVE-2021-38396 Missing Support Integrity Check for Boston Scientific Zoom Latitude

The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB...

CVE-2021-38392 Improper Access Control for Boston Scientific Zoom Latitude

A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world...

CVE-2021-38394 Missing Protection against Hardware Reverse Engineering Using Integrated Circuit Imaging Techniques for Boston Scientific Zoom Latitude

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted...

PT-2021-22110 · Boston Scientific · Zoom Latitude +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns the presence of unpatched vulnerabilities in off-the-shelf software components used by the affected device. A malicious attacker with physical access to the devic...

PT-2021-22109 · Boston Scientific · Zoom Latitude +1

Name of the Vulnerable Software and Affected Versions: Programmer installation utility affected versions not specified Description: The issue arises from the programmer installation utility's failure to perform cryptographic authenticity or integrity checks on the software stored on a flash drive...