Category: Advisories

  • Advisory: SQL Injection and Reflected Cross Site Scripting Vulnerabilities (CVE-201502849 and CVE-2015-2850)

    Publication Date: 06 Jul 2015 Description SQL Injection Vulnerability A vulnerability which allows user to perform queries on the underlying datastore via ppli URL parameter of the default login page main.ant; CVE-2015-2849 Cross-Site Scripting Vulnerability A reflected cross-site scripting vulnerability exists in the msg URL parameter of the admin login page index-login.ant; CVE-2015-2850 Impact A remote […]

  • Advisory: Rsync remote file system access vulnerability CVE-2015-0932

    Security Advisory Publication Date: 26 March 2015 Description An incorrect rsync configuration on certain models of our gateway products allows an external system to obtain unrestricted remote read/write file access. Impact A remote unauthenticated user with unrestricted access to the rsync port to affected gateway products may be allowed full read/write access to the file […]

  • UPDATE on Vulnerability CVE-2015-0932

    We would like to proactively inform you about a zero-day vulnerability found with some of our InnGate HSIA gateways. We also would like to update you that a fix for the vulnerability is already available since 26 Mar 2015 and that we are actively working with our partners to patch your InnGate to secure it. […]

  • Advisory: Glibc Vulnerability

    A buffer overflow vulnerability in the glibc gethostbyname() function was publicly announced on January 27, 2015. The issue is identified by CVE-2015-0235 and was given the name “Ghost.” The ANTlabs Engineering Team started investigating this issue immediately. This vulnerability is related to the various gethostbyname functions included in glibc and affect applications that call these functions. […]

  • Advisory on Darkhotel Malware

    Information has been circulated that there is a malware known as Darkhotel, which targets and compromises various hotel systems. This malware initiates targeted attacks to selected users when they check in to hotels by pushing Trojans, information stealers and key loggers into the user’s machine. Please be informed that the InnGate is safe from the […]

  • Advisory on SSL3 ‘Poodle’ vulnerability

    The “Poodle” vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw and every implementation of SSL 3.0 suffers from it. Note that we are talking about the old SSL 3.0, not TLS 1.0 or later. The TLS versions are not affected (neither is DTLS) by […]

  • Advisory: ShellShock Bash Vulnerability

    Please be informed that ANTlabs products are not affected by “ShellShock” Bash Vulnerability. This is mainly because our products are appliance-based and do not use bash for console shell access. Administrators use ANTlabs’ own customised shell (that is not subject to the ShellShock Bash vulnerability) to access the command line interface. In addition, these products […]

  • Advisory on OpenSSL Heartbleed Bug

    Please be informed that our gateways do not suffer from the recently reported SSL vulnerability also known as Open SSL Heartbleed Bug. The SSL keys used in our products are not generated using the affected libraries. Thank you.

  • Advisory: Login Page Issue

    We have received comments from users who encountered a warning message from the browsers that they are using. In Chrome it may look something like this: In other browsers, it may look like this:   The reason for this is because the browser treats web redirections as web hijacks. The InnGate is one of the […]

  • Advisory: 2048-bit SSL certificate support

    The 2048-bit SSL certificate is updated on the appliances below, which require client browser to access CRLs from the relevant certificate authority. InnGate 3 minimum patch level 47 SSG 4 minimum patch level 3 IG 3100 Therefore, the following wall garden rule is required to be configured under Network > LAN > Walled Garden > […]