ENTTEC Datagate MK2/Storm 24/Pixelator/E-Streamer MK2 70044_update_05032019-482 Directory Permission /usr/local permission

Summaryinfo

A vulnerability, which was classified as critical, has been found in ENTTEC Datagate MK2, Storm 24, Pixelator and E-Streamer MK2 70044_update_05032019-482. This affects an unknown part of the file /usr/local of the component Directory Permission. The manipulation leads to permission. This vulnerability is listed as CVE-2019-12777. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in ENTTEC Datagate MK2, Storm 24, Pixelator and E-Streamer MK2 70044_update_05032019-482 and classified as critical. This issue affects an unknown functionality of the file /usr/local of the component Directory Permission. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory permissions for all users. By default, /usr/local and all of its subdirectories should have permissions set to only allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing files in this location. The ENTTEC firmware startup script permits all users to read, write, and execute (rwxrwxrwx) from the /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin/ directories.

The weakness was presented 06/07/2019. The identification of this vulnerability is CVE-2019-12777 since 06/07/2019. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-136192 and VDB-136191 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• ENTTEC

Name

• Datagate MK2
• E-Streamer MK2
• Pixelator
• Storm 24

Version

• 70044_update_05032019-482

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion