Allele Security Intelligence

ASA-2019-00478 – PowerDNS Authoritative Server: Denial of service via crafted zone records

Posted on July 30, 2019August 5, 2019 by Allele Security Intelligence in Alerts

An issue has been found in PowerDNS Authoritative Server allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it tries to store the notified serial in the PostgreSQL database, if this serial cannot be represented in 31 bits.

ASA-2019-00475 – GLPI: Unsafe password reset

Posted on July 30, 2019August 3, 2019 by Allele Security Intelligence in Alerts

It has been discovered that the password reset feature is not safe. Indeed, after a successful password reset by a user, it is possible to change again his password during 24 hours without any knowledge except his email address.

ASA-2019-00473 – Mikrotik RouterOS: Memory exhaustion via a crafted POST request

Posted on July 26, 2019November 30, 2020 by Allele Security Intelligence in Alerts

This vulnerability is similar to the CVE-2018-1157. An authenticated user can cause the www binary to consume all memory via a crafted POST request to /jsproxy/upload. It's because of the incomplete fix for the CVE-2018-1157.