Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands, via a crafted web site.

fix for CVE-2018-5704 (RHBZ 1534844)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Josef Gajdusek discovered that OpenOCD, a JTAG debugger for ARM and MIPS, was vulnerable to Cross Protocol Scripting attacks. An attacker could craft a HTML page that, when visited by a victim running OpenOCD, could execute arbitrary commands on the victims host.

This fix also sets the OpenOCD default binding to localhost, instead of every network interfaces. This can be changed with the added 'bindto'command argument.

OpenOCD, an on-chip JTAG debug solution for ARM and MIPS systems, does not block attempts to use HTTP POST for sending data to localhost, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands, via a crafted website.

For Debian 7 'Wheezy', these problems have been fixed in version 0.5.0-1+deb7u1.

We recommend that you upgrade your openocd packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
122569	Fedora 28 : openocd (2019-f0add5eed0)	Nessus	Fedora Local Security Checks	critical
122556	Fedora 29 : openocd (2019-0a5e82cea8)	Nessus	Fedora Local Security Checks	critical
106213	Debian DSA-4093-1 : openocd - security update	Nessus	Debian Local Security Checks	critical
106209	Debian DLA-1253-1 : openocd security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-5704

critical

Tenable Plugins

critical

critical

critical

critical