Meinberg Security Advisory: [MBGSA-2025.05] LANTIME Firmware V7.08.025

Description of the Vulnerabilities

• Third-Party Software:
  • gnutls:

    • CVE-2025-32988 - Vulnerability in GnuTLS otherName SAN export (low)
      https://access.redhat.com/security/cve/CVE-2025-32988

    • CVE-2025-32989 - Vulnerability in GnuTLS SCT extension parsing (medium)
      https://access.redhat.com/security/cve/CVE-2025-32989

    • CVE-2025-32990 - Vulnerability in GnuTLS certtool template parsing (low)
      https://access.redhat.com/security/cve/CVE-2025-32990

    • CVE-2025-6395 - NULL pointer dereference in _gnutls_figure_common_ciphersuite() (medium)
      https://access.redhat.com/security/cve/CVE-2025-6395

    GNUTLS Security Advisories: https://www.gnutls.org/security-new.html

    Fixed in:
    V7.08.025 MBGID-25900

  • iputils:

    • CVE-2025-47268 - Fix signed 64-bit integer overflow in RTT calculation (medium)
      https://access.redhat.com/security/cve/cve-2025-47268

    • CVE-2025-48964 - Fix moving average rtt calculation (medium)
      https://access.redhat.com/security/cve/cve-2025-48964

    iputils Release Notification: https://github.com/iputils/iputils/releases/tag/20250602

    Fixed in:
    V7.08.025 MBGID-25668

  • libssh:

    • CVE-2025-5318 - Likely read beyond bounds in sftp server handle management (info)
      https://access.redhat.com/security/cve/CVE-2025-5318

      libssh Security Advisory: https://www.libssh.org/security/advisories/CVE-2025-5318.txt

    Fixed in:
    V7.08.025 MBGID-25679

    Note: The sftp functionality of the libssh library is not in use.

  • linux-pam:

    • CVE-2025-6020 - linux-pam directory Traversal (low)
      https://access.redhat.com/security/cve/CVE-2025-6020

    Fixed in:
    V7.08.025 MBGID-25613

    Note: The pam_namespace module is not used in any shipped configuration and could only be activated by manual intervention by users with the highest privileges.

  • sudo:

    • CVE-2025-32462 - Local Privilege Escalation via host option (low)
      https://access.redhat.com/security/cve/CVE-2025-32462

    • CVE-2025-32463 - Local Privilege Escalation via chroot option (low)
      https://access.redhat.com/security/cve/CVE-2025-32463

    sudo Security Advisories: https://www.sudo.ws/security/advisories/

    Fixed in:
    V7.08.025 MBGID-25762

    Note: Only users with the highest privileges can login to the shell and execute arbitrary sudo commands or can manually edit the sudo configuration in a way that renders it insecure.

• REST API:

  • NOCVE - Missing checks of password quality (low)
    
    Description: - The password validation function of the REST API did not check all requirements when setting passwords.

    Fixed in:
    V7.08.025 MBGID-25439

  • NOCVE - Deletion of higher privileged user (medium)
    
    Description: - A user with admin rights was able to delete users with higher privileges via the REST API.

    Fixed in:
    V7.08.025 MBGID-25438

Systems Affected

All LANTIME Firmware versions before 7.08.025 are affected by the corresponding vulnerabilities. The LANTIME Firmware is used by all devices of the LANTIME M-Series (M100, M150, M200, M250, M300, M320, M400, M450, M600, M900) as well as all devices of the LANTIME IMS series (M500, M1000, M1000S, M2000S, M3000, M3000S, M4000) and the SyncFire product family (SF1000, SF1100, SF1200, SF1500) and LANTIME CPU Expansions (LCES).

Whether and to what extent individual clients or LANTIME systems are vulnerable depends on the individual configuration, network infrastructure, and other factors, and it is therefore not possible to provide a general statement on how vulnerable a given system in use actually is.

Possible Security Measures

The relevant security updates are included in the LANTIME Firmware versions 7.08.025 and 7.08.025-light. Updating to these versions eliminates the listed vulnerabilities.

Download the latest LANTIME Firmware at:

• Meinberg LANTIME Firmware

The update is now available for Meinberg customers. An update of the LANTIME Firmware to Version 7.08.025 or 7.08.025-light is recommended. Clients who cannot install version 7.08.025 should install version 7.08.025-light instead.

Further Information

Further details and information are available from the following website:

• LANTIME Firmware Changelog: LTOS 7.08

If you have any questions or need assistance, please, do not hesitate to contact Meinberg’s Technical Support Team.

Acknowledgments

We would like to express our gratitude to all those who have advised us of vulnerabilities or other bugs, and have also suggested improvements to us.

Thank you!