Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service


*   Home
*   »
*   Knowledgebase
*   »
*   EFT
*   »
*   Is EFT susceptible to the "Denial of service via recursive...

**THE INFORMATION IN THIS ARTICLE APPLIES TO:**

*   EFT v8.0.0.38 and 8.0.x
*   This is fixed in EFT v8.1.0.16

**QUESTION**

Is EFT susceptible to the "Denial of service via recursive Deflate Stream" vulnerability?

**ANSWER**

Yes, you can be vulnerable if you are:

*   Administering EFT remotely
*   Allowing EFT remote administration to be initiated from the Internet
*   Using the default port
*   Not whitelisting trusted IPs

**MORE INFORMATION**

Sending a recursively compressed packet (a "quine") to the administration port can crash EFT. This can be mitigated by limiting access to administer EFT at the network level. You may be affected if you allow remote administration to EFT to be initiated from the internet. As stated in our best practices, do not expose port 1100 to the internet. You will always want to whitelist trusted IPs. The most secure method is to disallow remote administration outside of the host EFT server and only login in via localhost (::1 or 127.0.0.1).

**Share Article**

*   
*   

On a scale of 1-5, please rate the helpfulness of this article

Optionally provide additional feedback to help us improve this article...

**Thank you for your feedback!**

Last Modified: Last Week

Last Modified By: kmarsh

Type: HOTFIX

Article not rated yet.

Article has been viewed 2.7K times.

CVE-2023-2990: Is EFT susceptible to the "Denial of service via recursive Deflate Stream" vulnerability?

Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited


**THE INFORMATION IN THIS ARTICLE APPLIES TO:**

*   EFT v8.0.x - 8.1.0.14
*   This is fixed in v8.1.0.16

**QUESTION**

Is EFT susceptible to the "Authentication Bypass via Out-of-bounds Memory Read " vulnerability?

**ANSWER**

The possibility exists for malicious login attempts to eventually be mistaken as valid when a request is read beyond the payload buffer. Properly configured auto banning rules can avoid this type of attack. This is not a practical concern unless the administration port is exposed to external networks. This is even less of a concern if you are whitelisting expected IPs via the IP ban/access list for remote administration.

Yes, you can be vulnerable if you are:

*   Administering EFT remotely
*   Allowing EFT remote administration to be initiated from the Internet
*   Using the default admin port
*   Not whitelisting trusted IPs

**MORE INFORMATION**

This can be mitigated by limiting access to administer EFT at the network level. You may be affected if you allow remote administration to EFT to be initiated from the internet. As stated in our best practices, do not expose port 1100 to the internet. You will always want to whitelist trusted IP accesses. The most secure method is to disallow remote administration outside of the host EFT server and only login in via localhost, that is, ::1 or 127.0.0.1.

CVE-2023-2989: Is EFT susceptible to the "Authentication Bypass via Out-of-bounds Memory Read " vulnerability?

Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message


CVE-2023-2991: Multiple Vulnerabilities in Fortra Globalscape EFT Administration Server [FIXED]

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

**Library Powered By**

This library is powered by Entity Framework Extensions

**System.Linq.Dynamic.Core**

This is a **.NET Core / Standard port** of the Microsoft assembly for the .Net 4.0 Dynamic language functionality.

**Overview**

With this library it's possible to write Dynamic LINQ queries (string based) on an IQueryable:

var query \= db.Customers
    .Where("City == @0 and Orders.Count >= @1", "London", 10)
    .OrderBy("CompanyName")
    .Select("new(CompanyName as Name, Phone)");

Interpolated strings are supported on .NET 4.6(and above), .NET Core 2.1(and above), .NET Standard 1.3(and above) and UAP 10.0(and above). For example:

string cityName \= "London";
int c \= 10;
db.Customers.WhereInterpolated($"City == {cityName} and Orders.Count >= {c}");

**❗ Breaking changes****v1.3.0**

A breaking change is introduced in version 1.3.0 which is related to calling methods on classes. Due to security reasons, it's now only allowed to call methods on the standard predefined classes like (bool, int, string ...). If you want to call a method on an own custom class, annotate that class with the DynamicLinqType. Example:

\[DynamicLinqType\]
public class MyCustomClass
{
    public int GetAge(int x) \=> x;
}

If it's not possible to add that attribute, you need to implement a custom CustomTypeProvider and set this to the ParsingConfig and provide that config to the dynamic call.

**Useful links**

*   Website
*   Documentation
*   Online examples
*   NuGet

**Info**

_**Project**_

 

  **Chat**

  **Issues**

_**Quality**_

 

  **CI Workflow**

_**NuGet**_

 

  **System.Linq.Dynamic.Core**

  **EntityFramework.DynamicLinq**

  **Microsoft.EntityFrameworkCore.DynamicLinq**

  **Z.EntityFramework.Classic.DynamicLinq**

**Development Details****Frameworks**

The following frameworks are supported:

*   net35, net40, net45, net46 and up
*   netstandard1.3, netstandard2.0 and netstandard2.1
*   netcoreapp3.1, net5.0, net6.0 and net7.0
*   uap10.0

**Fork details**

This fork takes the basic library to a new level. Contains XML Documentation and examples on how to use it. Also adds unit testing to help ensure that it works properly.

Some background: I forked from https://github.com/NArnott/System.Linq.Dynamic and added some more functionality there.  
My fork is still visible on github \[https://github.com/StefH/System.Linq.Dynamic\], however I decided to start a new project + nuget to avoid confusion and create the project according to the new VS2017 + .NET Core rules / standards.

However, currently there are multiple nuget packages and projects available:

Project

NuGet

Author

Comment

kahanu/System.Linq.Dynamic

System.Linq.Dynamic

@kahanu

\-

kavun/System.Linq.Dynamic.3.5

System.Linq.Dynamic.3.5/

@kavun

only 3.5 and VB.NET

NArnott/System.Linq.Dynamic

System.Linq.Dynamic.Library

@NArnott

removed from github + nuget ?

dynamiclinq.codeplex

\-

dialectsoftware

\-

dynamic-linq

\-

scottgu

\-

**Contribute**

Want to help us? Your donation directly helps us maintain and grow ZZZ Free Projects.

We can't thank you enough for your support 🙏.

👍 One-time donation

❤️ Become a sponsor

**Why should I contribute to this free & open-source library?**

We all love free and open-source libraries! But there is a catch... nothing is free in this world.

We NEED your help. Last year alone, we spent over **3000 hours** maintaining all our open source libraries.

Contributions allow us to spend more of our time on: Bug Fix, Development, Documentation, and Support.

**How much should I contribute?**

Any amount is much appreciated. All our free libraries together have more than **100 million** downloads.

If everyone could contribute a tiny amount, it would help us make the .NET community a better place to code!

Another great free way to contribute is **spreading the word** about the library.

A **HUGE THANKS** for your help!

**More Projects**

*   EntityFramework Extensions
*   Dapper Plus
*   C# Eval Expression
*   and much more!

To view all our free and paid projects, visit our website.

CVE-2023-32571: GitHub - zzzprojects/System.Linq.Dynamic.Core: The .NET Standard / .NET Core version from the System Linq Dynamic functionality.

FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.

**Memory allocation failure in xml\_on\_metadata\_tag\_only() at dump\_xml.c:271**

Memory allocation failure in the flvmeta at function xml\_on\_metadata\_tag\_only in dump\_xml.c:271.

**Environment**

Ubuntu 18.04, 64 bit  
FLVMeta 1.2.1

**Steps to reproduce**

1.  download file

    wget https://github.com/noirotm/flvmeta/archive/refs/tags/v1.2.1.tar.gz
    tar -zxvf v1.2.1.tar.gz
    

2.  compile libming with ASAN

    cd flvmeta-1.2.1
    export FORCE_UNSAFE_CONFIGURE=1
    export LLVM_COMPILER=clang
    CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -Wno-error" cmake -DCMAKE_C_COMPILER=wllvm -DCMAKE_CXX_COMPILER=wllvm++ -B obj-bc -G"Unix Makefiles" 
    cd obj-bc
    make
    
    cd src
    extract-bc flvmeta
    clang -fsanitize=address flvmeta.bc -o flvmeta_asan
    

3.  command for reproducing the error

Download poc:  
flvmeta\_memory-allocation-failure\_dumpxml271.zip

**ASAN report**

    root@a71b82b5d288:~/dataset/flvmeta-1.2.1/obj-bc/src# ./flvmeta_asan flvmeta_memory-allocation-failure_dumpxml271 
    AddressSanitizer:DEADLYSIGNAL
    =================================================================
    ==30124==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000000489d7b bp 0x7fff17e62cb0 sp 0x7fff17e62440 T0)
    ==30124==The signal is caused by a READ memory access.
    ==30124==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
        #0 0x489d7b in __interceptor_strcmp.part.298 /root/LLVM/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:444
        #1 0x4fe908 in xml_on_metadata_tag_only /root/dataset/flvmeta-1.2.1/src/dump_xml.c:271:14
        #2 0x502563 in flv_parse /root/dataset/flvmeta-1.2.1/src/flv.c:506:26
        #3 0x4fd491 in dump_metadata /root/dataset/flvmeta-1.2.1/src/dump.c:160:14
        #4 0x502855 in main /root/dataset/flvmeta-1.2.1/src/flvmeta.c:385:50
        #5 0x7f8aa5304c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #6 0x41b819 in _start (/root/dataset/flvmeta-1.2.1/obj-bc/src/flvmeta_asan+0x41b819)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /root/LLVM/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:444 in __interceptor_strcmp.part.298
    ==30124==ABORTING

CVE-2023-36243: Memory allocation failure in xml_on_metadata_tag_only() at dump_xml.c:271 · Issue #19 · noirotm/flvmeta

libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.

**Allocation size overflow in parseSWF\_DEFINEFONTINFO() at parser.c:1948**

Allocation size overflow in the listswf at function parseSWF\_DEFINEFONTINFO in parser.c:1948.

**Environment**

Ubuntu 18.04, 64 bit  
libming 0.4.7

**Steps to reproduce**

1.  download file

    git clone https://github.com/libming/libming.git libming-ming-0_4_7
    

2.  compile libming with ASAN

    cd libming-ming-0_4_7
    git checkout 5aa3470
    ./autogen.sh
    export FORCE_UNSAFE_CONFIGURE=1
    export LLVM_COMPILER=clang
    CC=wllvm CXX=wllvm++ CFLAGS="-g -O0 -fcommon -Wno-error" ./configure --prefix=`pwd`/obj-bc --with-php-config=/usr/bin/php-config7.2 --enable-static --disable-shared
    make
    make install
    
    cd obj-bc/bin/
    extract-bc listswf
    clang -fsanitize=address -lz -lm listswf.bc -o listswf_asan
    

3.  command for reproducing the error

Download poc:  
libming\_0-4-7\_listswf\_allocation-size-overflow\_parser1948.zip

**ASAN report**

    root@a71b82b5d288:~/dataset/libming-ming-0_4_7/obj-bc/bin# ./listswf_asan libming_0-4-7_listswf_allocation-size-overflow_parser1948.swf 
    header indicates a filesize of 6350 but filesize is 296
    File version: 10
    File size: 296
    Frame size: (0,0)x(0,0)
    Frame rate: 237.609375 / sec.
    Total frames: 31640
    =================================================================
    ==29667==ERROR: AddressSanitizer: requested allocation size 0xfffffffffffffed6 (0x6d8 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
        #0 0x4ade60 in malloc /root/LLVM/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x50fefd in parseSWF_DEFINEFONTINFO /root/dataset/libming-ming-0_4_7/util/parser.c:1948:34
        #2 0x4fefda in blockParse /root/dataset/libming-ming-0_4_7/util/blocktypes.c:145:14
        #3 0x4fceb2 in readMovie /root/dataset/libming-ming-0_4_7/util/main.c:265:11
        #4 0x4fca7d in main /root/dataset/libming-ming-0_4_7/util/main.c:350:2
        #5 0x7fa41cb57c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    
    ==29667==HINT: if you don't care about these errors you may set allocator_may_return_null=1
    SUMMARY: AddressSanitizer: allocation-size-too-big /root/LLVM/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145 in malloc
    ==29667==ABORTING

CVE-2023-36239: Allocation size overflow in parseSWF_DEFINEFONTINFO() at parser.c:1948 · Issue #273 · libming/libming

Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, allows unauthenticated attackers to execute arbitrary code via the org_name or domain values.

CVE-2023-34796: Anonymous Stored XSS for Email Admins

XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider (IP) to impersonate any TOPdesk user via SAML Response manipulation.

CVE-2023-34923

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.


\-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:04.pam\_krb5 Security Advisory The FreeBSD Project Topic: Network authentication attack via pam\_krb5 Category: core Module: pam\_krb5 Announced: 2023-06-21 Credits: Taylor R Campbell Affects: All supported versions of FreeBSD Corrected: 2023-06-21 05:25:18 UTC (stable/13, 13.2-STABLE) 2023-06-21 05:27:12 UTC (releng/13.2, 13.2-RELEASE-p1) 2023-06-21 05:27:22 UTC (releng/13.1, 13.1-RELEASE-p8) 2023-06-21 05:27:27 UTC (stable/12, 12.4-STABLE) 2023-06-21 05:43:39 UTC (releng/12.4, 12.4-RELEASE-p3) CVE Name: CVE-2023-3326 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background Kerberos 5 (krb5) is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. The PAM (Pluggable Authentication Modules) library provides a flexible framework for user authentication and session setup / teardown. pam\_krb5 is a PAM module that allows using a Kerberos password to authenticate the user. pam\_krb5 is disabled in the default FreeBSD installation. pam\_krb5 uses passwords for authentication, which is distinct from Kerberos native protocols like GSSAPI, which allows for login without the exchange of passwords. GSSAPI is not affected by this issue. II. Problem Description pam\_krb5 authenticates the user by essentially running kinit(1) with the password, getting a \`ticket-granting ticket' (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. Normally, the system running the pam\_krb5 module will also have a keytab, a key provisioned by the KDC. The pam\_krb5 module will use the tgt to get a service ticket and validate it against the keytab, ensuring the tgt is valid and therefore, the password is valid. However, if a keytab is not provisioned on the system, pam\_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. III. Impact In a non-default FreeBSD installation that leverages pam\_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system. IV. Workaround If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam\_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam\_krb5 commented out. If you are using Kerberos, but not using pam\_krb5, ensure pam\_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam\_krb5 commented out. If you are using pam\_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64, i386, or (on FreeBSD 13 and later) arm64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-23:04/pam\_krb5.patch # fetch https://security.FreeBSD.org/patches/SA-23:04/pam\_krb5.patch.asc # gpg --verify pam\_krb5.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the PAM module, or reboot the system. VI. Correction details This issue is corrected by the corresponding Git commit hash or Subversion revision number in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/13/ 6322a6c9daaa stable/13-n255613 releng/13.2/ 58d21e3e8e56 releng/13.2-n254620 releng/13.1/ 07e3f54f2ea1 releng/13.1-n250186 stable/12/ r373100 releng/12.4/ r373103 - ------------------------------------------------------------------------- For FreeBSD 13 and later: Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD For FreeBSD 12 and earlier: Run the following command to see which files were modified by a particular revision, replacing NNNNNN with the revision number: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmSSkl0ACgkQbljekB8A Gu/7pxAA5piBa4nYH+o+h2zGENXpWnKfGXpbWvxA1y9GCEhVAyq0xNK1voVbeLxO j0JriahVImk+JjYgbuFSqQ44viRVUssIn2+tCT/rzWxjCYOAN7E5tHHuomzBtM6O JSyeTT5Hk58iOjseTxCOy+FkLZ1daHyUiEGxURAJGf/KLg532xnYAgoXli48JBdA 3QwQ/q6hUEYS2KJpV3s8EI2oss2SI8+SW+5YjtPCHrs5JhVvRo4803Gwgxexu8Hv ZO8oBb+R0+C9Q30ediAmHTrWdb1/ir5T/4kE/dOYNo3yeHBkpb5hqXEiAareFMhP LvgFOFg8tNR6BEO3brRkgITvcLQOq48JSQlB1/ROE2+abSS0W1wEFlm/vyWen6as 0lMJYcO3+eTlKRkJ8fJyUZFntKk8s+ys8wNYYMoUr2AK89JvxtvIrL4kfZJ2SyHw OwRCXpDx+rT4EXrspDsU3ya9mlT/+GVvMDD0J7eRpY8T+TKhp9P5VtofYAidw+tP GafiRcuj8YLuHGTKlRQtmy3tE9jXsZ2p/R9bBt94ARPG0K/iJA7uR5gFs8PLXfpA GxIGJwif6jFEFUXg5pufwTDmW0g4BNL7rWzO2l7ZDxE7tdgSH0qr4D376VyI385d mzjiGNJZ07ng8R5MAXUDeqsZA1RvG5BV3toJawMzessvf55R1EI= =YOWz -----END PGP SIGNATURE-----

CVE-2023-3326

Advantech R-SeeNet 
versions 2.4.22 
allows low-level users to access and load the content of local files.





Source

CVE