Publication Date: 10th Jan 2018 Last Updated: 19th Jan 2018 Version 1.04: Interim Description On 3rd January 2018, 3 vulnerabilities were disclosed for Intel microprocessors that could allow an attacker that has local access to a server to read privileged information belonging to other processes or the operating system by installing and executing a malicious […]
Publication Date: 17 November 2016 Description There is a PMS default setting on the Fidelio Opera system which specifies that the PMS will ignore DB sync request less than 60s. With this default setting configured, the Opera PMS will ignore all DB sync requests that it receives from our gateway within 60s of establishing connection. This […]
Publication Date: 06 Jul 2015 Description SQL Injection Vulnerability A vulnerability which allows user to perform queries on the underlying datastore via ppli URL parameter of the default login page main.ant; CVE-2015-2849 Cross-Site Scripting Vulnerability A reflected cross-site scripting vulnerability exists in the msg URL parameter of the admin login page index-login.ant; CVE-2015-2850 Impact A remote […]
Security Advisory Updated: 12 Jan 2022 Publication Date: 26 March 2015 Description An incorrect rsync configuration on certain models of our gateway products allows an external system to obtain unrestricted remote read/write file access. Impact A remote unauthenticated user with unrestricted access to the rsync port to affected gateway products may be allowed full read/write […]
We would like to proactively inform you about a zero-day vulnerability found with some of our InnGate HSIA gateways. We also would like to update you that a fix for the vulnerability is already available since 26 Mar 2015 and that we are actively working with our partners to patch your InnGate to secure it. […]
A buffer overflow vulnerability in the glibc gethostbyname() function was publicly announced on January 27, 2015. The issue is identified by CVE-2015-0235 and was given the name “Ghost.” The ANTlabs Engineering Team started investigating this issue immediately. This vulnerability is related to the various gethostbyname functions included in glibc and affect applications that call these functions. […]
The “Poodle” vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw and every implementation of SSL 3.0 suffers from it. Note that we are talking about the old SSL 3.0, not TLS 1.0 or later. The TLS versions are not affected (neither is DTLS) by […]
Please be informed that ANTlabs products are not affected by “ShellShock” Bash Vulnerability. This is mainly because our products are appliance-based and do not use bash for console shell access. Administrators use ANTlabs’ own customised shell (that is not subject to the ShellShock Bash vulnerability) to access the command line interface. In addition, these products […]
Please be informed that our gateways do not suffer from the recently reported SSL vulnerability also known as Open SSL Heartbleed Bug. The SSL keys used in our products are not generated using the affected libraries. Thank you.