Details of VAR-201510-0774

ID

VAR-201510-0774

TITLE

Multiple routers contain issue in preventing clickjacking attacks

Trust: 0.8

sources: JVNDB: JVNDB-2015-000172

DESCRIPTION

Multiple router products contain an issue in the protection against clickjacking attacks. Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Multiple Routers are prone to a clickjacking vulnerability because it fails to perform validity checks on certain user actions through HTTP requests. Successful exploits will allow an attacker to compromise the affected device or obtain sensitive information. Other attacks are also possible

Trust: 0.99

sources: JVNDB: JVNDB-2015-000172 // BID: 77386

AFFECTED PRODUCTS

vendor:	multiple venders	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	yamaha	model:	srt100	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rtx810	scope:	eq	version:	11.1.21	Trust: 0.3
vendor:	yamaha	model:	rtx1500	scope:	-	version:	-	Trust: 0.3
vendor:	yamaha	model:	rtx1210	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rtx1200	scope:	eq	version:	10.1.59	Trust: 0.3
vendor:	yamaha	model:	rtv01	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt58i	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	rt107e	scope:	eq	version:	0	Trust: 0.3
vendor:	yamaha	model:	nvr500	scope:	eq	version:	11.0.25	Trust: 0.3
vendor:	yamaha	model:	fwx120	scope:	eq	version:	11.3.8	Trust: 0.3
vendor:	nec	model:	infocage	scope:	eq	version:	3.1	Trust: 0.3
vendor:	yamaha	model:	rtx810	scope:	ne	version:	11.1.25	Trust: 0.3
vendor:	yamaha	model:	rtx1200	scope:	ne	version:	10.1.65	Trust: 0.3
vendor:	yamaha	model:	nvr500	scope:	ne	version:	11.0.28	Trust: 0.3
vendor:	yamaha	model:	fwx120	scope:	ne	version:	11.3.13	Trust: 0.3
vendor:	nec	model:	infocage	scope:	ne	version:	5.1	Trust: 0.3

sources: BID: 77386 // JVNDB: JVNDB-2015-000172

CVSS

SEVERITY

CVSSV2

CVSSV3

IPA:	JVNDB-2015-000172
value:	LOW
Trust: 0.8

IPA:	JVNDB-2015-000172
severity:	LOW
baseScore:	2.6
vectorString:	AV:N/AC:H/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

sources: JVNDB: JVNDB-2015-000172

PROBLEMTYPE DATA

problemtype:

CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2015-000172

THREAT TYPE

network

Trust: 0.3

sources: BID: 77386

TYPE

Design Error

Trust: 0.3

sources: BID: 77386

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-000172

PATCH

title:	Yamaha Corporation website	url:	http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn48135658.html	Trust: 0.8
title:	vulnera_20151127	url:	http://www.furukawa.co.jp/fitelnet/topic/vulnera_20151127.html	Trust: 0.8
title:	Information from Allied Telesis	url:	https://jvn.jp/jp/jvn48135658/522154/index.html	Trust: 0.8
title:	NV15-019	url:	http://jpn.nec.com/security-info/secinfo/nv15-019.html	Trust: 0.8
title:	PLANEX COMMUNICATIONS INC. website	url:	http://www.planex.co.jp/news/info/20151030_info.shtml	Trust: 0.8
title:	I-O DATA DEVICE, INC. website	url:	http://www.iodata.jp/support/information/2016/clickjacking/	Trust: 0.8

sources: JVNDB: JVNDB-2015-000172

EXTERNAL IDS

db:	JVN	id:	JVN48135658	Trust: 1.1
db:	JVNDB	id:	JVNDB-2015-000172	Trust: 0.8
db:	BID	id:	77386	Trust: 0.3

sources: BID: 77386 // JVNDB: JVNDB-2015-000172

REFERENCES

url:	http://jvn.jp/en/jp/jvn48135658/index.html	Trust: 1.1
url:	http://www.rtpro.yamaha.co.jp/rt/faq/security/jvn48135658.html	Trust: 0.3
url:	http://jpn.nec.com/security-info/secinfo/nv15-019.html	Trust: 0.3

sources: BID: 77386 // JVNDB: JVNDB-2015-000172

CREDITS

Noriaki Iwasaki of Cyber Defense Institute

Trust: 0.3

sources: BID: 77386

SOURCES

db:	BID	id:	77386
db:	JVNDB	id:	JVNDB-2015-000172

LAST UPDATE DATE

2022-05-17T02:02:28.205000+00:00

SOURCES UPDATE DATE

db:	BID	id:	77386	date:	2015-10-30T00:00:00
db:	JVNDB	id:	JVNDB-2015-000172	date:	2016-02-12T00:00:00

SOURCES RELEASE DATE

db:	BID	id:	77386	date:	2015-10-30T00:00:00
db:	JVNDB	id:	JVNDB-2015-000172	date:	2015-10-30T00:00:00