Multiple vulnerabilities in Garrett Metal Detectors iC Module CMA

1) Stack-based buffer overflow

EUVDB-ID: #VU59087

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21903

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing UDP packets in the check_udp_crc() function of the CMA Connect software for Garrett PD 6500i and Garrett MZ 6100 models. A remote attacker can specially crafted packets to port 6877/UDP, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1355

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Path traversal

EUVDB-ID: #VU59334

Risk: Low

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21907

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the CMA CLI getenv command functionality. A remote administrator can send a specially crafted HTTP request and read arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://talosintelligence.com/vulnerability_reports/TALOS-2021-1358

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Path traversal

EUVDB-ID: #VU59333

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21909

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in in the del .cnt|.log file delete command. A remote administrator can send a specially crafted HTTP request and delete arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://talosintelligence.com/vulnerability_reports/TALOS-2021-1359

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Path traversal

EUVDB-ID: #VU59332

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21908

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in "file" parameter in the handle_delete function. A remote administrator can send a specially crafted HTTP request and delete arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://talosintelligence.com/vulnerability_reports/TALOS-2021-1359

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Incorrect Implementation of Authentication Algorithm

EUVDB-ID: #VU59331

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21902

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to to bypass authentication process.

The vulnerability exists due to incorrect implementation of authentication algorithm in the CMA run_server_6877 functionality. A remote attacker can send a specially crafted request and bypass the authentication.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://talosintelligence.com/vulnerability_reports/TALOS-2021-1354

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU59330

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21901

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the CMA check_udp_crc function. A remote attacker can send a specially crafted packet, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://talosintelligence.com/vulnerability_reports/TALOS-2021-1353

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Stack-based buffer overflow

EUVDB-ID: #VU59329

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21906

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the "checkPassword" CMA readfile function. A remote administrator can use a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://talosintelligence.com/vulnerability_reports/TALOS-2021-1357

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Stack-based buffer overflow

EUVDB-ID: #VU59328

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21905

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the "get_ip" CMA readfile function. A remote administrator can use a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://talosintelligence.com/vulnerability_reports/TALOS-2021-1357

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Path traversal

EUVDB-ID: #VU59088

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21904

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a local user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing CLI setenv command arguments. A local user can run a specially crafted command to overwrite arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Garrett Metal Detectors iC Module CMA: 5.0

CPE2.3

• cpe:2.3:h:garrett_metal_detectors:garrett_metal_detectors_ic_module_cma:5.0:*:*:*:*:*:*:*

External links

http://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1356

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.