This is an old revision of the document!
Comrex Version Security Concerns and Firmware Fixes
|Security Concern||Any Comrex Products Affected?||Product(s) Affected||Minimum Secure Firmware Version|
|Dropbear SSH vulnerability for versions prior to 2016.74||YES||ACCESS 2USB, ACCESS Rackmount, BRIC-Link, and BRIC-Link II||4.0p10|
|A high-severity vulnerability has been reported in Linux that could be exploited by a low privilege attacker to gain full root access on an affected system. The vulnerability, identified as CVE-2017-1000367, was discovered by researchers at Qualys Security in Sudo's “get_process_ttyname()” function for Linux that could allow a user with Sudo privileges to run commands as root or elevate privileges to root.||NO|
|A new vulnerability has been found that potentially affects most versions of the Linux and Unix operating systems, in addition to Mac OS X (which is based around Unix). Known as the “Bash Bug” or “ShellShock,” the GNU Bash Remote Code Execution Vulnerability (CVE-2014-6271) could allow an attacker to gain control over a targeted computer if exploited successfully.||NO|
|Stack-based Buffer Overflow - CVE-2015-7547. The glibc DNS client side resolver is vulnerable to a stack-based buffer overflow when the getaddrinfo() library function is used. Software using this function may be exploited with attacker-controlled domain names, attacker-controlled DNS servers, or through a man-in-the-middle attack.||NO|