CVE-2015-0932 Missing authorization in n/a
Remote attackers can read or write arbitrary files on InnGate devices via unauthenticated rsync sessions on port 873.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-0932?
CVE-2015-0932 is a critical missing authorization vulnerability in n/a, published on 5 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E, InnGate 3.10 E, InnGate 3.01 G, and InnGate 3.10 G devices does not require authentication for rsync sessions, which allows remote attackers to read or write to arbitrary files via TCP traffic on port 873.
Weakness: CWE-264
Which versions are affected by CVE-2015-0932?
It affects 7 products.
Products include Antlabs Inngate Ig 3.00 E, Antlabs Inngate Ig 3.01 E, Antlabs Inngate Ig 3.02 E, Antlabs Inngate Ig 3.10 E, Antlabs Inngate Ig 3.10 G, Antlabs Inngate Ig 3100 and 1 more.
How do I fix CVE-2015-0932?
No fix has been published for CVE-2015-0932 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-0932 being exploited?
There is no known exploitation of CVE-2015-0932 in the wild and no public exploit code.
Sources
Also known as GHSA-h4pf-q6rm-x45m.