Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
6/1/2020
03:35 PM
50%
50%

26 IoT Flaws Enable Denial-of-Service Attacks, Privilege Escalation

Research details vulnerabilities in the Zephyr Real Time Operating Systems and MCUboot, both used in IoT devices and sensors.

Newly discovered vulnerabilities in Internet of Things (IoT) components could expose a range of connected devices to denial-of-service (DoS) attacks and privilege escalation, a researcher with NCC Group reports.

The report details 26 vulnerabilities in the Zephyr Real Time Operating Systems (RTOS), which is specifically designed for IoT applications, and MCUboot, an open source, hardware-independent bootloader seen as a "companion project" to Zephyr, said NCC Group technical director Jeremy Boone in a blog post on the research, which was conducted in January and February of 2020. 

Both of these components exist in a range of IoT sensors and devices including baby monitors, LEDs, smart wearables, and IoT wireless gateways. Zephyr RTOS is supported by several major vendors including Intel, NXP, Nordic Semiconductor, and Texas Instruments; it also supports a wide range of chipset architectures and development kits. 

NCC Group discovered 25 vulnerabilities affecting the Zephyr RTOS and one affecting MCUboot. Researchers found both locally and remotely exploitable memory corruption flaws, multiple paths that could let a compromised user application to escalate privilege to kernel mode, and multiple weaknesses in the design of certain exploit mitigation systems that exist in the kernel.

As of the research publication date, 15 of these 26 problems have been addressed.

"The remaining unpatched findings pose a low overall risk as they represent denial of service vulnerabilities, or opportunities to further harden the kernel by improving existing exploit mitigation systems," the report states. Zephyr has indicated to NCC Group that these lower-risk issues are outside the 90-day embargo policy and they will address them in a future release. 

Read more details and download the full findings here.

 
 
 
 
 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37759
PUBLISHED: 2021-07-31
A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2021-37760
PUBLISHED: 2021-07-31
A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2020-26564
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey['importFil...
CVE-2020-26565
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.
CVE-2020-26806
PUBLISHED: 2021-07-31
admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.