Stork TLS Certificate Validation Code Flawed, Leading to Potential Data Loss and Denial of Service

CVE-2024-28872

Summary

The Stork management tool by ISC has a vulnerability in its TLS certificate validation process, which could be exploited by attackers. By obtaining a TLS certificate from the Stork server, an attacker can establish a connection with the Stork agent. This allows the attacker to send malicious commands to services monitored by Stork, such as Kea or BIND 9. The potential repercussions include unauthorized access to sensitive data and service disruption. It's crucial to note that the issue lies specifically with the Stork tool and does not directly affect Kea or BIND 9.

References