Skip to content
OpenAdvisories
Medium WID-SEC-2023-1553 6 CVEs

HCL BigFix: Mehrere Schwachstellen

Published Jun 22, 2023 · Updated Jun 22, 2023 · de-DE

Vendor: HCL Software Product: BigFix Product: BigFix OS Deployment and Bare Metal Imaging < site version 109 Product: BigFix OSD Bare Metal Server < version 311.19 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um das Opfer auf bösartige Webseiten umzuleiten.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 6

  • High 7.5
    CVE-2023-0215

    Use-after-free following BIO_new_NDEF

    The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io
  • High 7.4
    CVE-2023-0286 Public exploit EPSS 68%

    X.400 address type confusion in X.509 GeneralName

    There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI crates.io
  • High 7.0
    CVE-2023-28006

    HCL BigFix OSD Bare Metal Server is affected by a weak cryptographic algorithm.

    The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.

    HCL Software HCL BigFix OSD Bare Metal Server
  • Medium 5.9
    CVE-2022-4304 Public exploit EPSS 24%

    Timing Oracle in RSA Decryption

    A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io
  • Low 3.1
    CVE-2023-28016

    HCL BigFix OSD Bare Metal Server is affected by a host header injection vulnerability

    Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.

    HCL Software HCL BigFix OSD Bare Metal Server
  • Low 2.4
    CVE-2023-23343

    HCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability.

    A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled …

    HCL Software HCL BigFix OSD Bare Metal Server

Revision history

  1. #1

    Initiale Fassung

References