Vulnerability found in Yoggie Pico
Published: 04 Jul 2007 17:08 BST
A vulnerability has been found in Linux-based USB security device Yoggie Pico.
Yoggie Pico sits on a device, such as a laptop, and monitors web traffic to detect and block malware.
The zero-day vulnerability was disclosed on Monday by vulnerability researcher Cody Brocious.
Sentry Posts Blog
Guarding the network
What you need to know — and what you and your peers have to tell us — about security management in our new community group blog
Brocious said in his post that remote code execution was possible by subverting the "ping" function in the Yoggie web interface. "They expose a 'ping' function in their web interface for diagnostic purposes, which passes the IP/hostname given directly to ping in the form of 'ping -c 10
Avi Dardick, Yoggie's senior director of product management and support, said that the vulnerability had been fixed and that an update was released within 30 minutes of being disclosed.
Dardick played down the vulnerability, and denied that remote code execution was possible. "This was not remote execution, as the vulnerability requires access from the computer the device is supposed to connect to, to begin with, which requires an SSL handshake, and to begin processing you need to enter the username and password," he said. "With this in mind, yes, you could have hacked our Linux, but the exploit was by no means remote."
Did you find this article useful?
19 out of 19 people found this useful
- Share this article:
