Link to article: Redzone RedDB Archive Asynchronous Copy Vulnerability.
:scp-wiki:component:license-box
:scp-wiki:component:license-box-end
[[>]] [[module Rate]] [[/>]] [[include component:redzone-advisory |title=Redzone RedDB Archive Asynchronous Copy Vulnerability |id=redzone-sa-43647822-async-copy |updated=2015-7-13 |published=2015-7-10 |version=1.1 |impact=10.0 |worknd=true |bugs=RZux59834 RZux59902 |cve=CVE-2015-2804 |cwe=CWE-362 CWE-689 ]] ---- ++ Summary A vulnerability in the asynchronous copy routine used by the Redzone[[footnote]]Redzone Security is a database security company formed in 2001 from part of the former Prometheus Labs.[[/footnote]] RedDB ASA-5500 Series Archival Storage Appliance allows certain malicious archive contents to cause arbitrary data to be loaded into protected memory segments and executed as program code when the archive media is read. This vulnerability is due to incomplete sanitization of archive contents, allowing thaumatic contagion between the archive data and the operating system routines used to mark regions of memory as in use. A remote attacker could exploit this vulnerability by inserting a specially-crafted self-modifying infohazard into an affected archive database, which could then mutate into a form that triggers this vulnerability. ++ Affected Products Affected Redzone RedDB Software running on the following products may be affected by this vulnerability: ||~ Vulnerable Product ||~ Fixed In: || || Redzone RedDB ASA-5500 Series Archival Storage Appliance || 4.3.30 || || Redzone RedDB ASA-5500-P Series Physical Document Storage Appliance || 4.3.31 || || Redzone Infohazard Content Management System (ICMS) || 2.14.10 || || Redzone Distributed Nonlocal Database System (DND) || 1.19.11 || ++ Indicators of Compromise This vulnerability is known to be exploited by the Adament [sic] adware virus[[footnote]][[[SCP-2234]]][[/footnote]]. The presence of this exploit is a strong indicator that your system is compromised, and can be detected from these symptoms: * Appearance of unwanted banner ads attached to items retrieved from compromised equipment. * Appearance of animated advertisements on paper archive media. * Appearance of targeted advertisements referencing confidential personnel history. * Networked printers printing coupons containing anomalous memetic elements. ++ Workarounds The following measures may be taken to reduce the potential for adverse consequences resulting from this vulnerability: * Ensure the network is equipped with an up-to-date active infohazard detection system. * Install Adblock software on any computer used to interact with affected systems. * Install memetic filter firewalls on all networked printers. * Train users of affected systems to recognise and report computer security issues. ++ Fixed Software When considering software upgrades, customers are advised to consult the Redzone Security Advisories and Responses archive and review subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Redzone Technical Assistance Center (TAC) or their contracted maintenance providers. ++ Exploitation and Public Announcements The Redzone Security Incident Team (RSIT) is aware that this vulnerability has been exploited in the Adament [sic] adware virus. RSIT is not aware of any prior public disclosure of this vulnerability. ++ Source **2015-07-07:** Gloria McDuffie and Walter Sotomayor of SCP Foundation MTF Rho-9 reported this vulnerability to Redzone. [[footnoteblock]] [[div]] [[=]] [[include :scp-wiki:component:license-box]] ===== [[<]] > **Filename:** redzone3.png > **Author:** [[*user AJMansfield]] > **License:** CC BY-SA 3.0 [[/<]] ===== [[include :scp-wiki:component:license-box-end]] [[/=]] [[/div]]