Multiple security vulnerabilities in Secure Elements Class 5 AVR (EVM)
US-CERT published 19 (!!!) advisories about vulnerabilities in Secure Element's Class 5 AVR (Automated Vulnerability Remediation). The product is also known as C5 EVM (Enterprise Vulnerability Management). It allows auditing, evaluation and compliance with various policies. You can find more information about the product at http://www.secure-elements.com/products/index.htm.
There are too many vulnerabilities to list them here, but they look very bad ? starting from hard-coded user IDs and passwords, over same encryption settings for every message session to typical input validation vulnerabilities.
You can find the complete list at US-CERT's web site; http://www.kb.cert.org/vuls/bypublished.
The vulnerability is reportedly patched in the latest version of the product, C5 EVM 2.8.1.
Thanks to Juha-Matti for reporting this.
There are too many vulnerabilities to list them here, but they look very bad ? starting from hard-coded user IDs and passwords, over same encryption settings for every message session to typical input validation vulnerabilities.
You can find the complete list at US-CERT's web site; http://www.kb.cert.org/vuls/bypublished.
The vulnerability is reportedly patched in the latest version of the product, C5 EVM 2.8.1.
Thanks to Juha-Matti for reporting this.
Keywords:
0 comment(s)
My next class:
Web App Penetration Testing and Ethical Hacking | Amsterdam | Mar 31st - Apr 5th 2025 |
×
Diary Archives
Comments