Subject: [sacm] Potential Vulnerabilities to Consider for the Hackathon

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Mon, 10 Jul 2017 13:19:48 +0000

The following are a few vulnerabilities for use during the hackathon if we care to do so. It is likely that one of these should be available on our target Linux platform.

Apache Struts: https://nvd.nist.gov/vuln/detail/CVE-2017-5638
Linux kernel: https://dirtycow.ninja/ (also https://nvd.nist.gov/vuln/detail/CVE-2016-5195)
Xen: https://nvd.nist.gov/vuln/detail/CVE-2017-10912
Ncurses: https://nvd.nist.gov/vuln/detail/CVE-2017-10685
Perl XML-LibXML: https://nvd.nist.gov/vuln/detail/CVE-2017-10672

Regards,
Dave

---

From: Adam Montville <[email-masked]>
Date: Mon, 10 Jul 2017 15:10:13 +0000

Thanks for sharing these. I've put them up on our README file:
https://github.com/sacmwg/vulnerability-scenario/tree/master/ietf_99_hackathon

Kind regards,

Adam

On Mon, Jul 10, 2017 at 8:19 AM Waltermire, David A. (Fed) <
[email-masked]> wrote:

> The following are a few vulnerabilities for use during the hackathon if we
> care to do so. It is likely that one of these should be available on our
> target Linux platform.
>
> Linux kernel: https://dirtycow.ninja/ (also
> https://nvd.nist.gov/vuln/detail/CVE-2016-5195)
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Andreas Steffen <[email-masked]>
Date: Thu, 13 Jul 2017 21:48:56 +0200

Hi Dave,

I'm attaching the strongTNC REST API queries that are needed to
retrieve the endpoints vulnerable to the Ncurses CVE-2017-10685.

See you in Prague

Andreas

-- 
======================================================================
Andreas Steffen                         [email-masked]
strongSwan - the Open Source VPN Solution!          www.strongswan.org
Institute for Networked Solutions
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[INS-HSR]==

---

From: "Haynes, Dan" <[email-masked]>
Date: Fri, 14 Jul 2017 19:51:48 +0000

Not sure if we need it, but, I think this CVE requires a configuration check.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8740

Thanks,

Danny

From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Monday, July 10, 2017 5:10 PM
To: Waltermire, David A. (Fed) <[email-masked]>; [email-masked]
Subject: Re: [sacm] Potential Vulnerabilities to Consider for the Hackathon

Thanks for sharing these. I've put them up on our README file: https://github.com/sacmwg/vulnerability-scenario/tree/master/ietf_99_hackathon

Kind regards,

Adam

On Mon, Jul 10, 2017 at 8:19 AM Waltermire, David A. (Fed) <[email-masked]<mailto:[email-masked]>> wrote:
The following are a few vulnerabilities for use during the hackathon if we care to do so. It is likely that one of these should be available on our target Linux platform.

Regards,
Dave

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm