T Bi Tak Bi Lgem Software Technologies Research Institute
Monthly
Incorrect permission assignment on a critical resource in Pardus LightDM Greeter allows a local low-privileged user to read sensitive authentication material or tamper with greeter configuration, achieving high confidentiality and integrity impact without elevated rights. All versions before 0.4.15 of the greeter - a graphical login component shipped with Pardus, the Turkish government-backed Linux distribution maintained by TÜBİTAK BİLGEM - are affected. No public exploit or active exploitation has been identified; a vendor-released patch is available. No special configuration is required beyond having a local user account on an affected system.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
Hard-coded credentials in TÜBİTAK BİLGEM's Liderahenk Linux endpoint management platform (all versions before 3.5.5) let a remote, unauthenticated attacker log in using built-in default/common username-password pairs, yielding an authentication bypass with high confidentiality and integrity impact. Because Liderahenk centrally administers fleets of Pardus/Linux clients, valid access to its management interface exposes managed-endpoint policies and configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Turkey's national CERT (TR-CERT).
eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.
Incorrect permission assignment on a critical resource in Pardus LightDM Greeter allows a local low-privileged user to read sensitive authentication material or tamper with greeter configuration, achieving high confidentiality and integrity impact without elevated rights. All versions before 0.4.15 of the greeter - a graphical login component shipped with Pardus, the Turkish government-backed Linux distribution maintained by TÜBİTAK BİLGEM - are affected. No public exploit or active exploitation has been identified; a vendor-released patch is available. No special configuration is required beyond having a local user account on an affected system.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
Hard-coded credentials in TÜBİTAK BİLGEM's Liderahenk Linux endpoint management platform (all versions before 3.5.5) let a remote, unauthenticated attacker log in using built-in default/common username-password pairs, yielding an authentication bypass with high confidentiality and integrity impact. Because Liderahenk centrally administers fleets of Pardus/Linux clients, valid access to its management interface exposes managed-endpoint policies and configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Turkey's national CERT (TR-CERT).
eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.