medium6.8
CVE-2017-11400
An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00.
Impact
An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signature allows a local attacker to upgrade the equipment (kernel, file system) with unsigned, attacker-controlled, data. This occurs because the appliance_config file is signed but the .tar.sec file is unsigned.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Belden | Tofino Xenon Security Appliance Firmware | through 3.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/airbus-seclab/security-advisories/blob/master/belden/tofino.txt
- https://www.belden.com/hubfs/support/security/bulletins/Belden-Security-Bulletin-BSECV-2017-14-1v1-1.pdf
- https://github.com/airbus-seclab/security-advisories/blob/master/belden/tofino.txt
- https://www.belden.com/hubfs/support/security/bulletins/Belden-Security-Bulletin-BSECV-2017-14-1v1-1.pdf