Vulnerability Note VU#288121

Secure Elements Class 5 AVR client fails to validate source address of messages

Secure Elements Class 5 AVR (Automated Vulnerability Remediation) is a security product that monitors and enforces security policies on network assets. Class 5 AVR is now known as C5 EVM (Enterprise Vulnerability Management). The Class 5 AVR software includes both server and client components.

Class 5 AVR client

The Class 5 AVR client listens on 60000/udp and an additional tcp port. This client receives commands sent by the Class 5 AVR server.

Class 5 AVR server

The Class 5 AVR server is available as an appliance or as software that runs on commodity hardware. The Class 5 AVR server contains information about network assets, vulnerabilities, and remediation history.

The problem

The Class 5 AVR client does not validate the source address of messages that it receives.

II. Impact

This issue has been resolved in C5 EVM 2.8.1.

Systems Affected

http://www.secure-elements.com/products/index.htm

Credit

Thanks to the NOAA N-CIRT Lab for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.