Allele Security Alert
ASA-2019-00324
Identifier(s)
ASA-2019-00324, CVE-2019-8282, KLCERT-19-029
Title
Man-in-the-middle (MITM) attack due to the use of cleartext communication
Vendor(s)
Gemalto
Product(s)
Gemalto Admin Control Center
Affected version(s)
Gemalto Admin Control Center all versions prior to 7.92
Fixed version(s)
Gemalto Admin Control Center version 7.92
Proof of concept
Unknown
Description
Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs.
This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.
Technical details
Unknown
Credits
Artem Zinenko (Kaspersky Lab ICS CERT)
Reference(s)
KLCERT-19-029: Gemalto Admin Control Center uses cleartext communication with www3.safenet-inc.com
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/
CVE-2019-8282
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8282
CVE-2019-8282
https://nvd.nist.gov/vuln/detail/CVE-2019-8282
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: June 10, 2019