National Cyber Awareness System

Vulnerability Summary for CVE-2006-2708

Overview

Secure Elements Class 5 AVR client (aka C5 EVM) before 2.8.1 allows remote attackers to read portions of process memory via a modified size for (1) EM_GET_CE_PARAMETER and (2) EM_SET_CE_PARAMETER messages, which leads to a buffer overflow (probably an over-read).

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

Solution

Upgrade to version 2.8.1}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#873409

Name: VU#873409

Hyperlink:http://www.kb.cert.org/vuls/id/873409

US-CERT Vulnerability Note: VU#227929

Name: VU#227929

Hyperlink:http://www.kb.cert.org/vuls/id/227929

External Source: VUPEN

Name: ADV-2006-2069

Hyperlink:http://www.vupen.com/english/advisories/2006/2069

External Source: CONFIRM

Name: http://www.kb.cert.org/vuls/id/WDON-6QAK6D

Hyperlink:http://www.kb.cert.org/vuls/id/WDON-6QAK6D

External Source: SECUNIA

Name: 20378

Hyperlink:http://secunia.com/advisories/20378

External Source: XF

Name: c5evm-emgetceparameter-bo(26778)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26778

External Source: XF

Name: c5evm-emsetceparameter-bo(26745)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26745

External Source: SECTRACK

Name: 1016184

Hyperlink:http://securitytracker.com/id?1016184