The Secure Elements Class 5 AVR server fails to validate the source address of messages it receives. This may allow an attacker to forge messages to the server.
Class 5 AVR
Secure Elements Class 5 AVR (Automated Vulnerability Remediation) is a security product that monitors and enforces security policies on network assets. Class 5 AVR is now known as C5 EVM (Enterprise Vulnerability Management). The Class 5 AVR software includes both server and client components.
A remote, unauthenticated attacker may be able to forge client messages. This can allow an attacker to intercept communications initiated by the server. An attacker may also be able to alter the client information stored by the server.
Upgrade or patch
Thanks to the NOAA N-CIRT Lab for reporting this vulnerability.
This document was written by Will Dormann.
|Date First Published:||2006-05-30|
|Date Last Updated:||2006-06-07 03:00 UTC|