Skip to content
This repository was archived by the owner on May 14, 2024. It is now read-only.

Commit 5ba6cc1

Browse files
committed
Merge branch 'release/2017_11_08'
2 parents a491271 + beb24a3 commit 5ba6cc1

94,736 files changed

Lines changed: 4735270 additions & 4712708 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ Release 2017-03-30
55

66
### Change Log ###
77

8+
2017-11-08 Updated data. Sorted JSON keys so future updates should
9+
diff more cleanly in git commit logs.
10+
811
2017-03-30 Updated data. Some more CVSS scores backfilled.
912

1013
2016-11-03 Updated data. Backfilled "Not Defined" values for many

data/0/vu_101400/vu_101400.json

Lines changed: 74 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,78 +1,78 @@
11
{
2-
"Impact": "The complete impact of this vulnerability is not yet known.",
3-
"CVSS_SecurityRequirementsIR": "Not Defined (ND)",
4-
"CVSS_EnvironmentalVector": "CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)",
5-
"Title": "Artes Marciales Mixtas Mx (com.wArtesMarcialesMixtasMx) fails to properly validate SSL certificates",
6-
"DateFirstPublished": "",
7-
"CVSS_AccessVector": "--",
8-
"CAM_ScoreCurrentWidelyKnown": 0,
9-
"IDNumber": "101400",
10-
"SystemsAffectedPreamble": "",
11-
"CVSS_SecurityRequirementsCR": "Not Defined (ND)",
12-
"CVSS_Authenication": "--",
13-
"CVSS_BaseScore": 0,
14-
"CAM_EaseOfExploitation": "0",
15-
"IPProtocol": "",
16-
"CERTAdvisory": "",
17-
"CVSS_CollateralDamagePotential": "Not Defined (ND)",
18-
"Revision": 0,
19-
"CVEIDs": "",
20-
"VRDA_D1_DirectReport": "1",
21-
"CAM_WidelyKnown": "0",
22-
"CAM_Population": "0",
23-
"Description": "",
24-
"CVSS_AccessComplexity": "--",
25-
"CVSS_SecurityRequirementsAR": "Not Defined (ND)",
26-
"Resolution": "The CERT/CC is currently unaware of a practical solution to this problem.",
27-
"Author": "This document was written by Will Dormann.",
28-
"CAM_Exploitation": "0",
29-
"DateLastUpdated": "2014-12-26T19:28:13-05:00",
30-
"CVSS_IntegrityImpact": "--",
31-
"VRDA_D1_Population": "4",
32-
"CVSS_TemporalVector": "E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)",
33-
"CVSS_ReportConfidence": "Not Defined (ND)",
34-
"CVSS_ConfidentialityImpact": "--",
35-
"CVSS_BaseVector": "AV:--/AC:--/Au:--/C:--/I:--/A:--",
36-
"VulnerabilityCount": 1,
37-
"CVSS_Exploitability": "Not Defined (ND)",
38-
"ThanksAndCredit": "",
39-
"US-CERTTechnicalAlert": "",
40-
"CAM_ScoreCurrentWidelyKnownExploited": 0,
41-
"CVSS_TemporalScore": 0,
42-
"VRDA_D1_Impact": "3",
43-
"CVSS_TargetDistribution": "Not Defined (ND)",
44-
"CAM_InternetInfrastructure": "0",
45-
"CVSS_RemediationLevel": "Not Defined (ND)",
46-
"Workarounds": "",
47-
"ID": "VU#101400",
48-
"CVSS_AvailabilityImpact": "--",
49-
"CAM_ScoreCurrent": 0,
50-
"Overview": "",
51-
"CAM_Impact": "0",
52-
"DatePublic": "2012-10-16T00:00:00",
53-
"DateCreated": "2014-12-26T19:28:12-05:00",
54-
"References": [
55-
"https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
56-
"http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html",
57-
"http://developer.android.com/training/articles/security-ssl.html",
58-
"http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers",
59-
"http://android-ssl.org/",
60-
"http://android-ssl.org/files/p49.pdf",
61-
"http://android-ssl.org/files/p50-fahl.pdf",
62-
"http://cwe.mitre.org/data/definitions/295.html",
63-
"http://cwe.mitre.org/data/definitions/296.html"
64-
],
2+
"Author": "This document was written by Will Dormann.",
3+
"CAM_AttackerAccessRequired": "0",
4+
"CAM_EaseOfExploitation": "0",
5+
"CAM_Exploitation": "0",
6+
"CAM_Impact": "0",
7+
"CAM_InternetInfrastructure": "0",
8+
"CAM_Population": "0",
9+
"CAM_ScoreCurrent": 0,
10+
"CAM_ScoreCurrentWidelyKnown": 0,
11+
"CAM_ScoreCurrentWidelyKnownExploited": 0,
12+
"CAM_WidelyKnown": "0",
13+
"CERTAdvisory": "",
14+
"CVEIDs": "",
15+
"CVSS_AccessComplexity": "--",
16+
"CVSS_AccessVector": "--",
17+
"CVSS_Authenication": "--",
18+
"CVSS_AvailabilityImpact": "--",
19+
"CVSS_BaseScore": 0,
20+
"CVSS_BaseVector": "AV:--/AC:--/Au:--/C:--/I:--/A:--",
21+
"CVSS_CollateralDamagePotential": "Not Defined (ND)",
22+
"CVSS_ConfidentialityImpact": "--",
23+
"CVSS_EnvironmentalScore": 0,
24+
"CVSS_EnvironmentalVector": "CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)",
25+
"CVSS_Exploitability": "Not Defined (ND)",
26+
"CVSS_IntegrityImpact": "--",
27+
"CVSS_RemediationLevel": "Not Defined (ND)",
28+
"CVSS_ReportConfidence": "Not Defined (ND)",
29+
"CVSS_SecurityRequirementsAR": "Not Defined (ND)",
30+
"CVSS_SecurityRequirementsCR": "Not Defined (ND)",
31+
"CVSS_SecurityRequirementsIR": "Not Defined (ND)",
32+
"CVSS_TargetDistribution": "Not Defined (ND)",
33+
"CVSS_TemporalScore": 0,
34+
"CVSS_TemporalVector": "E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)",
35+
"DateCreated": "2014-12-26T19:28:12-05:00",
36+
"DateFirstPublished": "",
37+
"DateLastUpdated": "2014-12-26T19:28:13-05:00",
38+
"DatePublic": "2012-10-16T00:00:00",
39+
"Description": "",
40+
"ID": "VU#101400",
41+
"IDNumber": "101400",
42+
"IPProtocol": "",
43+
"Impact": "The complete impact of this vulnerability is not yet known.",
6544
"Keywords": [
66-
"Mallodroid",
67-
"SSL",
68-
"MITM",
69-
"Java",
70-
"Android",
71-
"Google",
72-
"HTTPS",
73-
"DRD19-J",
45+
"Mallodroid",
46+
"SSL",
47+
"MITM",
48+
"Java",
49+
"Android",
50+
"Google",
51+
"HTTPS",
52+
"DRD19-J",
7453
"Android SSL"
75-
],
76-
"CVSS_EnvironmentalScore": 0,
77-
"CAM_AttackerAccessRequired": "0"
54+
],
55+
"Overview": "",
56+
"References": [
57+
"https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
58+
"http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html",
59+
"http://developer.android.com/training/articles/security-ssl.html",
60+
"http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers",
61+
"http://android-ssl.org/",
62+
"http://android-ssl.org/files/p49.pdf",
63+
"http://android-ssl.org/files/p50-fahl.pdf",
64+
"http://cwe.mitre.org/data/definitions/295.html",
65+
"http://cwe.mitre.org/data/definitions/296.html"
66+
],
67+
"Resolution": "The CERT/CC is currently unaware of a practical solution to this problem.",
68+
"Revision": 0,
69+
"SystemsAffectedPreamble": "",
70+
"ThanksAndCredit": "",
71+
"Title": "Artes Marciales Mixtas Mx (com.wArtesMarcialesMixtasMx) fails to properly validate SSL certificates",
72+
"US-CERTTechnicalAlert": "",
73+
"VRDA_D1_DirectReport": "1",
74+
"VRDA_D1_Impact": "3",
75+
"VRDA_D1_Population": "4",
76+
"VulnerabilityCount": 1,
77+
"Workarounds": ""
7878
}
Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
2-
"Status": "Affected",
3-
"VendorReferences": "http://www.retrospect.com/support/kb/cve_2015_2864",
4-
"Vendor": "Retrospect, Inc.",
5-
"DateResponded": "2015-06-11T16:20:06-04:00",
6-
"DateLastUpdated": "2015-06-15T17:07:00-04:00",
7-
"DateNotified": "2015-04-30T17:06:19-04:00",
8-
"VendorRecordID": "GWAN-9XDS5M",
9-
"Addendum": "There are no additional comments at this time.",
10-
"VendorInformation": "Retrospect has released updates addressing these issues. Windows users should update to version 10.0.2.119 or later. Mac users should update to version 12.0.2.116 or later. Linux users should update to version 10.0.2.104 or later. The public key authentication method used by Retrospect is unaffected by this vulnerability. Retrospect recommends using public key authentication rather than a password and has provided a knowledge base article to guide users through the setup process.",
11-
"VendorStatement": "No statement is currently available from the vendor regarding this vulnerability.",
12-
"ID": "VU#101500",
13-
"Revision": 2
2+
"Addendum": "There are no additional comments at this time.",
3+
"DateLastUpdated": "2015-06-15T17:07:00-04:00",
4+
"DateNotified": "2015-04-30T17:06:19-04:00",
5+
"DateResponded": "2015-06-11T16:20:06-04:00",
6+
"ID": "VU#101500",
7+
"Revision": 2,
8+
"Status": "Affected",
9+
"Vendor": "Retrospect, Inc.",
10+
"VendorInformation": "Retrospect has released updates addressing these issues. Windows users should update to version 10.0.2.119 or later. Mac users should update to version 12.0.2.116 or later. Linux users should update to version 10.0.2.104 or later. The public key authentication method used by Retrospect is unaffected by this vulnerability. Retrospect recommends using public key authentication rather than a password and has provided a knowledge base article to guide users through the setup process.",
11+
"VendorRecordID": "GWAN-9XDS5M",
12+
"VendorReferences": "http://www.retrospect.com/support/kb/cve_2015_2864",
13+
"VendorStatement": "No statement is currently available from the vendor regarding this vulnerability."
1414
}

data/0/vu_101500/vu_101500.json

Lines changed: 64 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,68 @@
11
{
2-
"Impact": "An unauthenticated attacker on the network may be able to brute force a correct password by guessing a string that produces the same hash, granting access to backup data as the victim user.",
3-
"CVSS_SecurityRequirementsIR": "ND",
4-
"CVSS_EnvironmentalVector": "CDP:ND/TD:M/CR:ND/IR:ND/AR:ND",
5-
"Title": "Retrospect Backup Client uses weak password hashing",
6-
"DateFirstPublished": "2015-06-15T17:08:35-04:00",
7-
"CVSS_AccessVector": "A",
8-
"CAM_ScoreCurrentWidelyKnown": 0,
9-
"IDNumber": "101500",
10-
"SystemsAffectedPreamble": "",
11-
"CVSS_SecurityRequirementsCR": "ND",
12-
"CVSS_Authenication": "N",
13-
"CVSS_BaseScore": 7.9,
14-
"CAM_EaseOfExploitation": "0",
15-
"IPProtocol": "",
16-
"CERTAdvisory": "",
17-
"CVSS_CollateralDamagePotential": "ND",
18-
"Revision": 29,
19-
"CVEIDs": "CVE-2015-2864",
20-
"VRDA_D1_DirectReport": "1",
21-
"CAM_WidelyKnown": "0",
22-
"CAM_Population": "0",
23-
"Description": "CWE-916: Use of Password Hash With Insufficient Computational Effort - CVE-2015-2864 Retrospect Backup clients prior to 10.0.2 on Windows and Linux and 12.0.2 on Mac contain an error in the password hash generating algorithm. The password is not fully utilized when generating a hash, allowing the possibility of a weak hash with a higher probability of collision with other passwords. Attackers with network access to a machine running the Retrospect client may be able to generate brute-force passwords that are guaranteed to collide with the hashed password with a maximum of 128 tries. This attack was demonstrated by security researchers Josep Pi Rodriguez and Pedro Guillen Nunez. This vulnerability only affects clients utilizing password authentication; clients using the public key authentication mechanism to login are unaffected. Retrospect recommends that users make use of the public key authentication mechanism. For more details on the vulnerability and instructions on enabling public key authentication, please see Retrospect's advisory.",
24-
"CVSS_AccessComplexity": "M",
25-
"CVSS_SecurityRequirementsAR": "ND",
26-
"Resolution": "Apply an update For users that wish to continue using the password mechanism, Retrospect has released updates addressing this issue. Windows users should update to version 10.0.2.119 or later. Mac users should update to version 12.0.2.116 or later. Linux users should update to version 10.0.2.104 or later. Affected users may also consider the following workaround recommended by the vendor:",
27-
"Author": "This document was written by Garret Wassermann.",
28-
"CAM_Exploitation": "0",
29-
"DateLastUpdated": "2015-06-15T17:42:00-04:00",
30-
"CVSS_IntegrityImpact": "C",
31-
"VRDA_D1_Population": "3",
32-
"CVSS_TemporalVector": "E:POC/RL:OF/RC:C",
33-
"CVSS_ReportConfidence": "C",
34-
"CVSS_ConfidentialityImpact": "C",
35-
"CVSS_BaseVector": "AV:A/AC:M/Au:N/C:C/I:C/A:C",
36-
"VulnerabilityCount": 1,
37-
"CVSS_Exploitability": "POC",
38-
"ThanksAndCredit": "Thanks to Josep Pi Rodriguez and Pedro Guillen Nunez for working with the CERT/CC and the vendor, and thanks to Retrospect for quickly addressing the issue.",
39-
"US-CERTTechnicalAlert": "",
40-
"CAM_ScoreCurrentWidelyKnownExploited": 0,
41-
"CVSS_TemporalScore": 6.2,
42-
"VRDA_D1_Impact": "3",
43-
"CVSS_TargetDistribution": "M",
44-
"CAM_InternetInfrastructure": "0",
45-
"CVSS_RemediationLevel": "OF",
46-
"Workarounds": "Switch to Public Key Authentication The public key authentication method used by Retrospect is unaffected by this vulnerability. Retrospect recommends using public key authentication rather than a password and has provided a knowledge base article to guide users through the setup process.",
47-
"ID": "VU#101500",
48-
"CVSS_AvailabilityImpact": "C",
49-
"CAM_ScoreCurrent": 0,
50-
"Overview": "Retrospect Backup Client is a client to a network-based backup utility. This client stores passwords in a hashed format that is weak and susceptible to collision, allowing an attacker to generate a password hash collision and gain access to the target's backup files.",
51-
"CAM_Impact": "0",
52-
"DatePublic": "2014-07-09T00:00:00",
53-
"DateCreated": "2015-03-02T12:18:48-05:00",
54-
"References": [
55-
"http://www.retrospect.com/support/kb/cve_2015_2864",
56-
"http://www.retrospect.com/support/downloads",
57-
"https://www.youtube.com/watch?v=MB8AL5u7JCA&list=PL3UAg9Zuj1yLmemIKw-domjg5UkbN-pLc&index=14"
58-
],
2+
"Author": "This document was written by Garret Wassermann.",
3+
"CAM_AttackerAccessRequired": "0",
4+
"CAM_EaseOfExploitation": "0",
5+
"CAM_Exploitation": "0",
6+
"CAM_Impact": "0",
7+
"CAM_InternetInfrastructure": "0",
8+
"CAM_Population": "0",
9+
"CAM_ScoreCurrent": 0,
10+
"CAM_ScoreCurrentWidelyKnown": 0,
11+
"CAM_ScoreCurrentWidelyKnownExploited": 0,
12+
"CAM_WidelyKnown": "0",
13+
"CERTAdvisory": "",
14+
"CVEIDs": "CVE-2015-2864",
15+
"CVSS_AccessComplexity": "M",
16+
"CVSS_AccessVector": "A",
17+
"CVSS_Authenication": "N",
18+
"CVSS_AvailabilityImpact": "C",
19+
"CVSS_BaseScore": 7.9,
20+
"CVSS_BaseVector": "AV:A/AC:M/Au:N/C:C/I:C/A:C",
21+
"CVSS_CollateralDamagePotential": "ND",
22+
"CVSS_ConfidentialityImpact": "C",
23+
"CVSS_EnvironmentalScore": 4.64042060842752,
24+
"CVSS_EnvironmentalVector": "CDP:ND/TD:M/CR:ND/IR:ND/AR:ND",
25+
"CVSS_Exploitability": "POC",
26+
"CVSS_IntegrityImpact": "C",
27+
"CVSS_RemediationLevel": "OF",
28+
"CVSS_ReportConfidence": "C",
29+
"CVSS_SecurityRequirementsAR": "ND",
30+
"CVSS_SecurityRequirementsCR": "ND",
31+
"CVSS_SecurityRequirementsIR": "ND",
32+
"CVSS_TargetDistribution": "M",
33+
"CVSS_TemporalScore": 6.2,
34+
"CVSS_TemporalVector": "E:POC/RL:OF/RC:C",
35+
"DateCreated": "2015-03-02T12:18:48-05:00",
36+
"DateFirstPublished": "2015-06-15T17:08:35-04:00",
37+
"DateLastUpdated": "2015-06-15T17:42:00-04:00",
38+
"DatePublic": "2014-07-09T00:00:00",
39+
"Description": "CWE-916: Use of Password Hash With Insufficient Computational Effort - CVE-2015-2864 Retrospect Backup clients prior to 10.0.2 on Windows and Linux and 12.0.2 on Mac contain an error in the password hash generating algorithm. The password is not fully utilized when generating a hash, allowing the possibility of a weak hash with a higher probability of collision with other passwords. Attackers with network access to a machine running the Retrospect client may be able to generate brute-force passwords that are guaranteed to collide with the hashed password with a maximum of 128 tries. This attack was demonstrated by security researchers Josep Pi Rodriguez and Pedro Guillen Nunez. This vulnerability only affects clients utilizing password authentication; clients using the public key authentication mechanism to login are unaffected. Retrospect recommends that users make use of the public key authentication mechanism. For more details on the vulnerability and instructions on enabling public key authentication, please see Retrospect's advisory.",
40+
"ID": "VU#101500",
41+
"IDNumber": "101500",
42+
"IPProtocol": "",
43+
"Impact": "An unauthenticated attacker on the network may be able to brute force a correct password by guessing a string that produces the same hash, granting access to backup data as the victim user.",
5944
"Keywords": [
60-
"weak hash",
61-
"crypto",
62-
"backup",
63-
"client",
45+
"weak hash",
46+
"crypto",
47+
"backup",
48+
"client",
6449
"CWE-916"
65-
],
66-
"CVSS_EnvironmentalScore": 4.64042060842752,
67-
"CAM_AttackerAccessRequired": "0"
50+
],
51+
"Overview": "Retrospect Backup Client is a client to a network-based backup utility. This client stores passwords in a hashed format that is weak and susceptible to collision, allowing an attacker to generate a password hash collision and gain access to the target's backup files.",
52+
"References": [
53+
"http://www.retrospect.com/support/kb/cve_2015_2864",
54+
"http://www.retrospect.com/support/downloads",
55+
"https://www.youtube.com/watch?v=MB8AL5u7JCA&list=PL3UAg9Zuj1yLmemIKw-domjg5UkbN-pLc&index=14"
56+
],
57+
"Resolution": "Apply an update For users that wish to continue using the password mechanism, Retrospect has released updates addressing this issue. Windows users should update to version 10.0.2.119 or later. Mac users should update to version 12.0.2.116 or later. Linux users should update to version 10.0.2.104 or later. Affected users may also consider the following workaround recommended by the vendor:",
58+
"Revision": 29,
59+
"SystemsAffectedPreamble": "",
60+
"ThanksAndCredit": "Thanks to Josep Pi Rodriguez and Pedro Guillen Nunez for working with the CERT/CC and the vendor, and thanks to Retrospect for quickly addressing the issue.",
61+
"Title": "Retrospect Backup Client uses weak password hashing",
62+
"US-CERTTechnicalAlert": "",
63+
"VRDA_D1_DirectReport": "1",
64+
"VRDA_D1_Impact": "3",
65+
"VRDA_D1_Population": "3",
66+
"VulnerabilityCount": 1,
67+
"Workarounds": "Switch to Public Key Authentication The public key authentication method used by Retrospect is unaffected by this vulnerability. Retrospect recommends using public key authentication rather than a password and has provided a knowledge base article to guide users through the setup process."
6868
}

0 commit comments

Comments
 (0)