Skip to content

Commit 2471c87

Browse files
harsh098TG1999
harsh098
and
TG1999
authored
Fix Encoding Type in Fireeye Importer (#1404)
* Fix Encoding Type in Fireeye Importer Signed-off-by: Harsh Mishra <[email protected]> * Add Test to Fireeye Importer This test checks for UTF-8-SIG encoding Signed-off-by: Harsh Mishra <[email protected]> * Reformat test_fireeye.py Signed-off-by: Harsh Mishra <[email protected]> --------- Signed-off-by: Harsh Mishra <[email protected]> Co-authored-by: Tushar Goel <[email protected]>
1 parent 174bf02 commit 2471c87

File tree

3 files changed

+77
-1
lines changed

3 files changed

+77
-1
lines changed

‎vulnerabilities/importers/fireeye.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ def advisory_data(self) -> Iterable[AdvisoryData]:
4444
if Path(file).stem == "README":
4545
continue
4646
try:
47-
with open(file) as f:
47+
with open(file, encoding="utf-8-sig") as f:
4848
yield parse_advisory_data(raw_data=f.read(), file=file, base_path=base_path)
4949
except UnicodeError:
5050
logger.error(f"Invalid file {file}")

‎vulnerabilities/tests/test_data/fireeye/fireeye_test3.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# MNDT-2023-0017
2+
3+
The IBM Personal Communications (PCOMM) application 13.0.0 and earlier caused a user's plaintext password to be written to the `C:\Temp\pcsnp_init.log` file when re-connection was made through a remote desktop protocol.
4+
5+
## Common Weakness Enumeration
6+
CWE-312: Cleartext Storage of Sensitive Information
7+
8+
## Impact
9+
High - An attacker with low-privilege access to a host with IBM PCOMM could recover the plaintext password of another user.
10+
11+
## Exploitability
12+
Low - Exploitability varies depending on the environment in which IBM PCOMM is installed. Mandiant identified this vulnerability when conducting independent security research for a client that used Citrix to connect to shared Windows Server instances. In certain environments where remote desktop is used to connect to shared hosts with IBM PCOMM installed, the exploitability is greatly increased.
13+
14+
## CVE Reference
15+
CVE-2016-0321 - scope expanded
16+
17+
## Technical Details
18+
While conducting independent security research, Mandiant identified a plaintext Active Directory password stored within the `C:\Temp\pcsnp_init.log` file. The affected host had IBM PCOMM version 13.0.0 installed and was used by multiple users who connected with Citrix. Upon a user connecting, disconnecting, and connecting again, the user's plaintext password was stored in the `C:\Temp\pcsnp_init.log` file.
19+
20+
## Discovery Credits
21+
- Adin Drabkin, Mandiant
22+
- Matthew Rotlevi, Mandiant
23+
24+
## Disclosure Timeline
25+
- 2023-09-26 - Issue reported to the vendor.
26+
- 2023-11-03 - The vendor updated the security bulletin for CVE-2016-0321 to include all known affected and fixed versions.
27+
28+
## References
29+
- [IBM Security Bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-personal-communications-could-allow-remote-user-obtain-sensitive-information-including-user-passwords-allowing-unauthorized-access-cve-2016-0321)
30+
- [IBM Personal Communications](https://www.ibm.com/support/pages/ibm-personal-communications)
31+
- [Mitre CVE-2016-0321](https://www.cve.org/CVERecord?id=CVE-2016-0321)

‎vulnerabilities/tests/test_fireeye.py‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,3 +172,48 @@ def test_parse_advisory_data_2(self):
172172
result = imported_data.to_dict()
173173

174174
util_tests.check_results_against_json(result, expected_file)
175+
176+
def test_md_list_to_dict_2(self):
177+
expected_output = {
178+
"# MNDT-2023-0017\n": [
179+
"\n",
180+
"The IBM Personal Communications (PCOMM) application 13.0.0 and earlier caused a user's plaintext password to be written to the `C:\\Temp\\pcsnp_init.log` file when re-connection was made through a remote desktop protocol.\n",
181+
"\n",
182+
],
183+
"## Common Weakness Enumeration\n": [
184+
"CWE-312: Cleartext Storage of Sensitive Information\n",
185+
"\n",
186+
],
187+
"## Impact\n": [
188+
"High - An attacker with low-privilege access to a host with IBM PCOMM could recover the plaintext password of another user.\n",
189+
"\n",
190+
],
191+
"## Exploitability\n": [
192+
"Low - Exploitability varies depending on the environment in which IBM PCOMM is installed. Mandiant identified this vulnerability when conducting independent security research for a client that used Citrix to connect to shared Windows Server instances. In certain environments where remote desktop is used to connect to shared hosts with IBM PCOMM installed, the exploitability is greatly increased.\n",
193+
"\n",
194+
],
195+
"## CVE Reference\n": ["CVE-2016-0321 - scope expanded\n", "\n"],
196+
"## Technical Details\n": [
197+
"While conducting independent security research, Mandiant identified a plaintext Active Directory password stored within the `C:\\Temp\\pcsnp_init.log` file. The affected host had IBM PCOMM version 13.0.0 installed and was used by multiple users who connected with Citrix. Upon a user connecting, disconnecting, and connecting again, the user's plaintext password was stored in the `C:\\Temp\\pcsnp_init.log` file.\n",
198+
"\n",
199+
],
200+
"## Discovery Credits\n": [
201+
"- Adin Drabkin, Mandiant\n",
202+
"- Matthew Rotlevi, Mandiant\n",
203+
"\n",
204+
],
205+
"## Disclosure Timeline\n": [
206+
"- 2023-09-26 - Issue reported to the vendor.\n",
207+
"- 2023-11-03 - The vendor updated the security bulletin for CVE-2016-0321 to include all known affected and fixed versions.\n",
208+
"\n",
209+
],
210+
"## References\n": [
211+
"- [IBM Security Bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-personal-communications-could-allow-remote-user-obtain-sensitive-information-including-user-passwords-allowing-unauthorized-access-cve-2016-0321)\n",
212+
"- [IBM Personal Communications](https://www.ibm.com/support/pages/ibm-personal-communications)\n",
213+
"- [Mitre CVE-2016-0321](https://www.cve.org/CVERecord?id=CVE-2016-0321)\n",
214+
],
215+
}
216+
with open(os.path.join(TEST_DATA, "fireeye_test3.md"), encoding="utf-8-sig") as f:
217+
md_list = f.readlines()
218+
md_dict = md_list_to_dict(md_list)
219+
assert md_dict == expected_output

0 commit comments

Comments
 (0)