Description
Secure Elements Class 5 AVR (aka C5 EVM) before 2.8.1 do not validate the source address of a message, which allows remote attackers to (1) execute arbitrary code on a client or (2) forge messages to the server.
References
- http://www.kb.cert.org/vuls/id/WDON-6Q6RYL
- 20378 third-party-advisory
- c5evm-server-source-message-spoofing(26747) vdb-entry
- http://www.kb.cert.org/vuls/id/WDON-6QANK7
- ADV-2006-2069 vdb-entry
- 1016184 vdb-entry
- VU#919345 third-party-advisory
- VU#288121 third-party-advisory