C4B OBD-II Dongle 2.x/3.4.x SSH Key weak authentication : 8/24/2015 3:38:24 AM
 | This eBook shows you how to build great push messages that convert for your app. From our sponsors  |
| Vulnerability Advisories |
| Vulnerabilities of scip VulDB |
C4B OBD-II Dongle 2.x/3.4.x SSH Key weak authentication
8/22/2015 7:00:00 PM
General
scipID: 77381
Affected: C4B OBD-II Dongle 2.x/3.4.x
Published: 08/23/2015
Risk: critical
Created: 08/24/2015
Entry: 65.8% complete
Summary
A vulnerability was found in C4B OBD-II Dongle 2.x/3.4.x. It has been rated as critical. This issue affects an unknown function of the component SSH Key. The manipulation with an unknown input leads to a weak authentication vulnerability. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
- DISPUTED ** Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers’ installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation. NOTE: the vendor states “This was a flaw for the developer/debugging devices (again not possible in production versions).”
The weakness was released 08/23/2015. The identification of this vulnerability is CVE-2015-2906. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available.
The real existence of this vulnerability is still doubted at the moment.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
CVSS
Base Score: 6.0 (CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P) [?]
Temp Score: 6.0 (CVSS2#E:ND/RL:ND/RC:ND) [?]
CPE
Exploiting
Class: Weak authentication
Local: No
Remote: Yes
Availability: No
Countermeasures
Recommended: no mitigation known
0-Day Time: 0 days since found
Timeline
08/23/2015 | Advisory disclosed
08/24/2015 | VulDB entry created
08/24/2015 | VulDB entry updated
Sources
Disputed: Yes
CVE: CVE-2015-2906 (mitre.org) (nvd.nist.org) (cvedetails.com)
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
