NVD

Id
83355  
Name
CVE-2017-6445  
Description
The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.  
Reject
 
CVSS Version
2  
CVSS Score
7.6  
Severity
High  
CVSS Base Score
7.6  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-06-28  
Published
2017-03-05  
Modified Date
2017-06-25  
Seq
2017-6445  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
409885 83355 CVE-2016-7655 94906  View
409886 83355 CVE-2016-7655 https://support.apple.com/HT207422  View
409887 83355 CVE-2016-7655 https://support.apple.com/HT207423  View
409888 83355 CVE-2016-7655 94906  View
409889 83355 CVE-2016-7655 https://support.apple.com/HT207422  View
409890 83355 CVE-2016-7655 https://support.apple.com/HT207423  View
411392 83355 CVE-2017-2995 96191  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
65782 JVNDB-2017-002121 Open Embedded Linux Entertainment Center の自動更新機能におけるリモートでアップデートパッケージを操作される脆弱性 Open Embedded Linux Entertainment Center (OpenELEC) の自動更新機能は、暗号化された接続も署名済のアップデートも使用しないため、リモートでアップデートパッケージを操作され、root のアクセス権を取得される脆弱性が存在します。 CVE-2017-6445 CVE-2017-6445 83355 7.6 8.1 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-002121.html 2017-03-03 2017-03-29 View