From 711dcaa18ff161d804914b8c309722f4b8a26d07 Mon Sep 17 00:00:00 2001 From: Madison Oliver Date: Thu, 10 Oct 2019 13:28:58 -0400 Subject: [PATCH] CVEs for VU#719689 --- 2019/9xxx/CVE-2019-9529.json | 66 ++++++++++++++++++++++++++++++++++-- 2019/9xxx/CVE-2019-9530.json | 66 ++++++++++++++++++++++++++++++++++-- 2019/9xxx/CVE-2019-9531.json | 66 ++++++++++++++++++++++++++++++++++-- 2019/9xxx/CVE-2019-9532.json | 66 ++++++++++++++++++++++++++++++++++-- 2019/9xxx/CVE-2019-9533.json | 66 ++++++++++++++++++++++++++++++++++-- 2019/9xxx/CVE-2019-9534.json | 66 ++++++++++++++++++++++++++++++++++-- 6 files changed, 378 insertions(+), 18 deletions(-) diff --git a/2019/9xxx/CVE-2019-9529.json b/2019/9xxx/CVE-2019-9529.json index 12fc68f7dbf..7af4d924091 100644 --- a/2019/9xxx/CVE-2019-9529.json +++ b/2019/9xxx/CVE-2019-9529.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cert@cert.org", + "DATE_PUBLIC": "2019-10-09T04:00:00.000Z", "ID": "CVE-2019-9529", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Explorer 710", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_name": "1.07", + "version_value": "1.07" + } + ] + } + } + ] + }, + "vendor_name": "Cobham plc" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was found by Kyle O'Meara and David Belasco." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,35 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local attacker connected to the device to access the portal and to make any change to the device." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.8" + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-284 Improper Access Control" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "VU#719689", + "refsource": "CERT-VN", + "url": "https://kb.cert.org/vuls/id/719689/" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9530.json b/2019/9xxx/CVE-2019-9530.json index 220db9a391b..93b648af536 100644 --- a/2019/9xxx/CVE-2019-9530.json +++ b/2019/9xxx/CVE-2019-9530.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cert@cert.org", + "DATE_PUBLIC": "2019-10-09T04:00:00.000Z", "ID": "CVE-2019-9530", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Explorer 710", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_name": "1.07", + "version_value": "1.07" + } + ] + } + } + ] + }, + "vendor_name": "Cobham plc" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was found by Kyle O'Meara and David Belasco." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,35 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an unauthenticated, local attacker connected to the device to access and download any file found in the web root directory." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.8" + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-284 Improper Access Control" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "VU#719689", + "refsource": "CERT-VN", + "url": "https://kb.cert.org/vuls/id/719689/" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9531.json b/2019/9xxx/CVE-2019-9531.json index 6943d84f7eb..60a9609e056 100644 --- a/2019/9xxx/CVE-2019-9531.json +++ b/2019/9xxx/CVE-2019-9531.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cert@cert.org", + "DATE_PUBLIC": "2019-10-09T04:00:00.000Z", "ID": "CVE-2019-9531", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Explorer 710", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_name": "1.07", + "version_value": "1.07" + } + ] + } + } + ] + }, + "vendor_name": "Cobham plc" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was found by Kyle O'Meara and David Belasco." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,35 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.8" + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-284 Improper Access Control" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "VU#719689", + "refsource": "CERT-VN", + "url": "https://kb.cert.org/vuls/id/719689/" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9532.json b/2019/9xxx/CVE-2019-9532.json index 99edf116b57..e380eefff14 100644 --- a/2019/9xxx/CVE-2019-9532.json +++ b/2019/9xxx/CVE-2019-9532.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cert@cert.org", + "DATE_PUBLIC": "2019-10-09T04:00:00.000Z", "ID": "CVE-2019-9532", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Explorer 710", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_name": "1.07", + "version_value": "1.07" + } + ] + } + } + ] + }, + "vendor_name": "Cobham plc" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was found by Kyle O'Meara and David Belasco." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,35 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.8" + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-319: Cleartext Transmission of Sensitive Information" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "VU#719689", + "refsource": "CERT-VN", + "url": "https://kb.cert.org/vuls/id/719689/" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9533.json b/2019/9xxx/CVE-2019-9533.json index 6c4e328aaf0..5c0765255f6 100644 --- a/2019/9xxx/CVE-2019-9533.json +++ b/2019/9xxx/CVE-2019-9533.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cert@cert.org", + "DATE_PUBLIC": "2019-10-09T04:00:00.000Z", "ID": "CVE-2019-9533", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Explorer 710", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "1.08", + "version_value": "1.08" + } + ] + } + } + ] + }, + "vendor_name": "Cobham plc" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was found by Kyle O'Meara and David Belasco." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,35 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.8" + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-522: Insufficiently Protected Credentials" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "VU#719689", + "refsource": "CERT-VN", + "url": "https://kb.cert.org/vuls/id/719689/" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9534.json b/2019/9xxx/CVE-2019-9534.json index d91fc3f1d61..d54e391bd32 100644 --- a/2019/9xxx/CVE-2019-9534.json +++ b/2019/9xxx/CVE-2019-9534.json @@ -1,9 +1,42 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "cert@cert.org", + "DATE_PUBLIC": "2019-10-09T04:00:00.000Z", "ID": "CVE-2019-9534", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Explorer 710", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_name": "1.07", + "version_value": "1.07" + } + ] + } + } + ] + }, + "vendor_name": "Cobham plc" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "This issue was found by Kyle O'Meara and David Belasco." + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +44,35 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.8" + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-494 Download of Code Without Integrity Check" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "VU#719689", + "refsource": "CERT-VN", + "url": "https://kb.cert.org/vuls/id/719689/" + } + ] + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file