NICMx Fort up to 1.6.4 Manifest manifestNumber/thisUpdate comparison

Summaryinfo

A vulnerability was found in NICMx Fort up to 1.6.4. It has been rated as problematic. This affects an unknown function of the component Manifest Handler. Performing a manipulation of the argument manifestNumber/thisUpdate results in comparison. This vulnerability was named CVE-2024-56170. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in NICMx Fort up to 1.6.4. This affects an unknown function of the component Manifest Handler. The manipulation of the argument manifestNumber/thisUpdate with an unknown input leads to a comparison vulnerability. CWE is classifying the issue as CWE-697. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses. The impact remains unknown. The summary by CVE is:

A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to verify. Assuming everything else is correct, the most recent version of a manifest should be prioritized over other versions, to prevent replays, accidental or otherwise. Manifests contain the manifestNumber and thisUpdate fields, which can be used to gauge the relevance of a given manifest, when compared to other manifests. The former is a serial-like sequential number, and the latter is the date on which the manifest was created. However, the product does not compare the up-to-dateness of the most recently fetched manifest against the cached manifest. As such, it's prone to a rollback to a previous version if it's served a valid outdated manifest. This leads to outdated route origin validation.

The advisory is shared at nicmx.github.io. This vulnerability is uniquely identified as CVE-2024-56170 since 12/18/2024. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 232091 (Linux Distros Unpatched Vulnerability : CVE-2024-56170), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.0.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (232091) and EUVD (EUVD-2024-52994). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• NICMx

Name

• Fort

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion