At any point of the digital transition,…
Two critical vulnerabilities discovered in ProlinOS could allow attackers to gain root access.
Sunday, November 1, 2020, 20:16 GMT
The First issue:
Vulnerability using 220.127.116.1159R, a concern was found in ProlinOS. By manipulating the setuid installation of the xtables-multi binary and using the ip6tables modprobe switch, a similar problem to CVE-2019-11360.0, an attacker with local code execution privileges as a regular user (MAINAPP) will escalate to root privilege.
The second vulnerability:
In ProlinOS, by 18.104.22.16859R, an unsigned-library problem was noticed. This OS includes installed programs and all device binaries to be signed by either the manufacturer or the creator and seller of the Point Of Sale program. The signature is a 2048-byte RSA signature checked before ELF execution in the kernel. However, shared libraries do not have to be registered, and are not checked. By compiling it as a shared object and loading it using LD PRELOAD, an attacker can execute a custom binary.
Update/Upgrade to any version higher than 22.214.171.12459R.
- Arbitrary read/write – CVE-2020-28044
- ELF signature bypass – CVE-2020-28045
- Root privesc – CVE-2020-28046
Suggested for you:TP-Link AC750 WiFi Extender (RE220), Covers Up to 1200 Sq.ft and 20 Devices, Up to 750Mbps Dual Band WiFi Range Extender, WiFi Booster to Extend Range of WiFi Internet Connection