CWE-347: Improper Verification of Cryptographic Signature
IOActive reports that Cobham's thraneLINK protocol does not verify cryptographic signatures for firmware updates before installing them. A remote unauthenticated attacker may use the SLPFindSrvs protocol function to discover thraneLINK devices on the network then send a crafted SNMP request to have the device download a firmware update from a TFTP server under the control of the attacker.
A remote unauthenticated attacker may be able to deploy a malicious firmware image to a thraneLINK device and execute arbitrary code.
We are currently unaware of a practical solution to this problem. Please consider the following workaround.
Thanks to Ruben Santamarta for reporting this vulnerability.
This document was written by Chris King.
|Date First Published:||2014-08-07|
|Date Last Updated:||2014-08-14 04:50 UTC|