SB2021102009 - Multiple vulnerabilities in AUVESY Versiondog
Published: October 20, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 secuirty vulnerabilities.
1) Improper access control (CVE-ID: CVE-2021-38457)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can initiate a session with the server without providing any form of authentication.
2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2021-38475)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to the database connection to the server is performed by calling a specific API. A remote authenticated attacker can gain SYSDBA permissions.
3) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2021-38461)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product uses a hard-coded blowfish key for encryption/decryption processes. A remote attacker can extract the key from binaries.
4) Out-of-bounds read (CVE-ID: CVE-2021-38451)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition. A remote authenticated attacker can trigger out-of-bounds read error and read contents of memory on the system.
5) Use-after-free (CVE-ID: CVE-2021-38467)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error. A remote attacker can control what memory regions will be freed and cause use-after-free condition.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Out-of-bounds write (CVE-ID: CVE-2021-38479)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input within many API function codes. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.
7) Write-what-where Condition (CVE-ID: CVE-2021-38449)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a write-what-where condition. A remote attacker can rewrite the memory in any location of the affected product.
8) Buffer overflow (CVE-ID: CVE-2021-38473)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing Microsoft Office files. A remote authenticated attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Arbitrary file upload (CVE-ID: CVE-2021-38471)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload within multiple API function. A remote attacker can upload a malicious file and execute it on the server.
10) External Control of File Name or Path (CVE-ID: CVE-2021-38477)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the multiple API function codes permit reading and writing data to or from files and directories. A remote attacker can manipulate and/or delete arbitrary files on the target system.
11) Input validation error (CVE-ID: CVE-2021-38453)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to some API functions allow interaction with the registry. A remote attacker can read values and modificate the data.
12) Input validation error (CVE-ID: CVE-2021-38455)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected product’s OS Service does not verify any given parameter. A remote authenticated attacker can supply any type of parameter that will be passed to inner calls without checking the type of the parameter or the value.
13) Resource exhaustion (CVE-ID: CVE-2021-38463)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote authenticated attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
14) Insecure DLL loading (CVE-ID: CVE-2021-38469)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can implant their own DLL near the affected product’s binaries and hijack the loaded DLL.
15) Authentication Bypass by Capture-replay (CVE-ID: CVE-2021-38459)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level. A remote attacker can bypass authentication process and change user passwords or delete the database.
16) SQL injection (CVE-ID: CVE-2021-38481)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data within JOB ID. A remote authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
17) Resource exhaustion (CVE-ID: CVE-2021-38465)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote authenticated attacker can trigger resource exhaustion and execute arbitrary code on the target system.
Remediation
Install update from vendor's website.