CVE-2021-38459: AUVESY Versiondog, заобикаляне на вход и права

Описание

Оригинално описание

The data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level. If a specific .exe is not restarted often, it is possible to access the needed handshake packets between admin/client connections. Using the SYSDBA permission, an attacker can change user passwords or delete the database.

Засегнати продукти

• AUVESY Versiondog: All до 8.0

Вид слабост

• CWE-294 Заобикаляне на автентикация чрез преизпълнение

История

Други уязвимости в AUVESY Versiondog

• 9.8CVE-2021-38449
• 9.8CVE-2021-38457
• 7.3CVE-2021-38455
• 4.8CVE-2021-38451
• 9.1CVE-2021-38453

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-38459
• https://nvd.nist.gov/vuln/detail/CVE-2021-38459
• https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01