Month: February 2022

EIP-db4e064b

A stack-based buffer overflow vulnerability exists within Xerox DocuShare. Exploitation of the vulnerability allows for attackers to execute arbitrary code with system privileges. The specific flaw exists within the parsing of AMI Pro (.sam) file formats. Parsing of this file structure is handled by the KeyView subsystem (lasr.dll).

Vulnerability Identifiers

• Exodus Intelligence: EIP-db4e064b
• MITRE CVE: CVE-2007-5909

Vulnerability Metrics

• CVSSv2 Score: 6.8

Vendor References

• https://securitydocs.business.xerox.com/wp-content/uploads/2022/02/DocuShare-Security-Bulletin-Regarding-CVE-2007-5909-and-CVE-2007-5910.pdf

Discovery Credit

• Exodus Intelligence

Disclosure Timeline

• Disclosed to affected vendor: December 10th, 2021
• Disclosed to public: February 24th, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

EIP-c728d1ef

A stack-based buffer overflow vulnerability exists within Xerox DocuShare. Exploitation of the vulnerability allows for attackers to execute arbitrary code with system privileges. The specific flaw exists within the parsing of containers embedded in WordPerfect (.wpd) file formats. Parsing of this file is handled by the KeyView subsystem (kvoop.exe).

Vulnerability Identifiers

• Exodus Intelligence: EIP-c728d1ef
• MITRE CVE: CVE-2007-5910

Vulnerability Metrics

• CVSSv2 Score: 9.3

Vendor References

• https://securitydocs.business.xerox.com/wp-content/uploads/2022/02/DocuShare-Security-Bulletin-Regarding-CVE-2007-5909-and-CVE-2007-5910.pdf

Discovery Credit

• Exodus Intelligence

Disclosure Timeline

• Disclosed to affected vendor: December 10th, 2021
• Disclosed to public: February 24th, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

EIP-6185db3e

A stack-based buffer overflow vulnerability exists within Xerox DocuShare. Exploitation of the vulnerability allows for attackers to execute arbitrary code with system privileges. The specific flaw exists within the parsing of “<:p tags” embedded in AMI Pro (.sam) file formats. Parsing of this file is handled by the KeyView subsystem (kvoop.exe).

Vulnerability Identifiers

• Exodus Intelligence: EIP-6185db3e
• MITRE CVE: CVE-2007-5909

Vulnerability Metrics

• CVSSv2 Score: 6.8

Vendor References

• https://securitydocs.business.xerox.com/wp-content/uploads/2022/02/DocuShare-Security-Bulletin-Regarding-CVE-2007-5909-and-CVE-2007-5910.pdf

Discovery Credit

• Exodus Intelligence

Disclosure Timeline

• Disclosed to affected vendor: December 10th, 2021
• Disclosed to public: February 24th, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

EIP-521a3b40

A cross-site request forgery vulnerability exists within the ZyXEL Armor Z1 AC2350 and Z2 AC2600 series. Exploitation of the vulnerability allows for attackers to run arbitrary commands on vulnerable versions of the firmware under the context of the root user. Exploitation requires either that the attacker has access to the local network or is able to coerce a local user into visiting a malicious website.

Vulnerability Identifiers

• Exodus Intelligence: EIP-521a3b40
• MITRE CVE: CVE-2021-4030

Vulnerability Metrics

• CVSSv2 Score: 7.9

Vendor References

• https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml

Discovery Credit

• Exodus Intelligence

Disclosure Timeline

• Disclosed to affected vendor: December 14th, 2021
• Disclosed to public: February 22nd, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

EIP-c624ba9f

A command-injection vulnerability exists within the ZyXEL Armor Z1 AC2350 series. The vulnerable endpoint is within the ‘photobak’ component found in the cgi-bin. Exploitation of the vulnerability allows for remote unauthenticated attackers to run arbitrary commands on vulnerable versions of the firmware under the context of the underlying lighthttpd subsystem.

Vulnerability Identifiers

• Exodus Intelligence: EIP-c624ba9f
• MITRE CVE: CVE-2021-4029

Vulnerability Metrics

• CVSSv2 Score: 8.3

Vendor References

• https://www.zyxel.com/support/forgery-vulnerabilities-of-select-Armor-home-routers.shtml
  

Discovery Credit

• Exodus Intelligence

Disclosure Timeline

• Disclosed to affected vendor: December 14th, 2021
• Disclosed to public: February 22nd, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at sales@exodusintel.com.

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.