Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
137 vulnerabilities by None
VAR-200605-0422
Vulnerability from variot - Updated: 2023-12-18 12:59Cross-site scripting (XSS) vulnerability in login_error.shtml for D-Link DSA-3100 allows remote attackers to inject arbitrary HTML or web script via an encoded uname parameter. D-Link DSA-3100 has a cross-site scripting vulnerability in login_error.shtml. This issue is due to a failure to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
TITLE: Elite-Board "search" Parameter Cross-Site Scripting Vulnerability
SECUNIA ADVISORY ID: SA20289
VERIFY ADVISORY: http://secunia.com/advisories/20289/
CRITICAL: Less critical
IMPACT: Cross Site Scripting
WHERE:
From remote
SOFTWARE: Elite-Board 1.x http://secunia.com/product/10164/
DESCRIPTION: luny has reported a vulnerability in Elite-Board, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the "search" parameter in search.html during searches is not properly sanitised before being returned to users.
The vulnerability has been reported in version 1.1. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
PROVIDED AND/OR DISCOVERED BY: luny
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
SOLUTION: Do not visit other web sites while accessing the gateway
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200605-0422",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dsa-3100 airspot gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "d link",
"version": "*"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "dsa-3100 airspot gateway",
"scope": null,
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "airspot dsa-3100 gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "BID",
"id": "18168"
},
{
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dsa-3100_airspot_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-2653"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "jaime blasco is credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "18168"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
],
"trust": 0.9
},
"cve": "CVE-2006-2653",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "CNVD-2006-3666",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "VHN-18761",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:N/AC:H/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-2653",
"trust": 1.0,
"value": "LOW"
},
{
"author": "CNVD",
"id": "CNVD-2006-3666",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-200605-520",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-18761",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "VULHUB",
"id": "VHN-18761"
},
{
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in login_error.shtml for D-Link DSA-3100 allows remote attackers to inject arbitrary HTML or web script via an encoded uname parameter. D-Link DSA-3100 has a cross-site scripting vulnerability in login_error.shtml. This issue is due to a failure to properly sanitize user-supplied input. \nAn attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. \n\nTITLE:\nElite-Board \"search\" Parameter Cross-Site Scripting Vulnerability\n\nSECUNIA ADVISORY ID:\nSA20289\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/20289/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nCross Site Scripting\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nElite-Board 1.x\nhttp://secunia.com/product/10164/\n\nDESCRIPTION:\nluny has reported a vulnerability in Elite-Board, which can be\nexploited by malicious people to conduct cross-site scripting\nattacks. \n\nInput passed to the \"search\" parameter in search.html during searches\nis not properly sanitised before being returned to users. \n\nThe vulnerability has been reported in version 1.1. Other versions\nmay also be affected. \n\nSOLUTION:\nEdit the source code to ensure that input is properly sanitised. \n\nPROVIDED AND/OR DISCOVERED BY:\nluny\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nSOLUTION:\nDo not visit other web sites while accessing the gateway",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "BID",
"id": "18168"
},
{
"db": "VULHUB",
"id": "VHN-18761"
},
{
"db": "PACKETSTORM",
"id": "46683"
},
{
"db": "PACKETSTORM",
"id": "46816"
}
],
"trust": 1.98
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-18761",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-18761"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "18168",
"trust": 2.6
},
{
"db": "NVD",
"id": "CVE-2006-2653",
"trust": 2.3
},
{
"db": "SECUNIA",
"id": "20343",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2006-2028",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1016173",
"trust": 1.7
},
{
"db": "SREASON",
"id": "980",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "20289",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2006-3666",
"trust": 0.6
},
{
"db": "XF",
"id": "26759",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20060527 D-LINK DSA-3100 CROSS-SITE SCRIPTING",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-81513",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "27923",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-18761",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "46683",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "46816",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "VULHUB",
"id": "VHN-18761"
},
{
"db": "BID",
"id": "18168"
},
{
"db": "PACKETSTORM",
"id": "46683"
},
{
"db": "PACKETSTORM",
"id": "46816"
},
{
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
]
},
"id": "VAR-200605-0422",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "VULHUB",
"id": "VHN-18761"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
}
]
},
"last_update_date": "2023-12-18T12:59:18.640000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-2653"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://www.eazel.es/media/advisory003-d-link-dsa-3100-cross-site-scripting.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/18168"
},
{
"trust": 1.7,
"url": "http://securitytracker.com/id?1016173"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/20343"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/980"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/435212/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/2028"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26759"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/20289"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/435212/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/26759"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/2028"
},
{
"trust": 0.3,
"url": "http://www.d-link.com/"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20289/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/10164/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20343/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/10210/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "VULHUB",
"id": "VHN-18761"
},
{
"db": "BID",
"id": "18168"
},
{
"db": "PACKETSTORM",
"id": "46683"
},
{
"db": "PACKETSTORM",
"id": "46816"
},
{
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "VULHUB",
"id": "VHN-18761"
},
{
"db": "BID",
"id": "18168"
},
{
"db": "PACKETSTORM",
"id": "46683"
},
{
"db": "PACKETSTORM",
"id": "46816"
},
{
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-05-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"date": "2006-05-30T00:00:00",
"db": "VULHUB",
"id": "VHN-18761"
},
{
"date": "2006-05-30T00:00:00",
"db": "BID",
"id": "18168"
},
{
"date": "2006-05-26T21:57:34",
"db": "PACKETSTORM",
"id": "46683"
},
{
"date": "2006-05-29T22:46:46",
"db": "PACKETSTORM",
"id": "46816"
},
{
"date": "2006-05-30T10:02:00",
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"date": "2006-05-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-05-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"date": "2018-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-18761"
},
{
"date": "2006-05-31T16:17:00",
"db": "BID",
"id": "18168"
},
{
"date": "2018-10-18T16:41:10.977000",
"db": "NVD",
"id": "CVE-2006-2653"
},
{
"date": "2006-05-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link Airspot DSA-3100 Gateway Login_error.SHTML Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3666"
},
{
"db": "BID",
"id": "18168"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
],
"trust": 1.5
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "46683"
},
{
"db": "PACKETSTORM",
"id": "46816"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-520"
}
],
"trust": 0.8
}
}
VAR-200612-0411
Vulnerability from variot - Updated: 2023-12-18 12:59Buffer overflow in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allows remote attackers to execute arbitrary code via crafted LDAP requests. Hitachi Directory Server is a directory server launched by Hitachi.
Secunia is proud to announce the availability of the Secunia Software Inspector.
The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor.
Try it out online: http://secunia.com/software_inspector/
TITLE: Hitachi Directory Server LDAP Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA23421
VERIFY ADVISORY: http://secunia.com/advisories/23421/
CRITICAL: Moderately critical
IMPACT: DoS, System access
WHERE:
From local network
SOFTWARE: Hitachi Directory Server 2.x http://secunia.com/product/4505/
DESCRIPTION: Some vulnerabilities have been reported in Hitachi Directory Server, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.
The vulnerabilities are reported in version 2. Prior versions may also be affected.
SOLUTION: Update to version 02-11-/K (Windows) or 02-10-/V (HP-UX).
PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.
ORIGINAL ADVISORY: http://www.hitachi-support.com/security_e/vuls_e/HS06-018_e/index-e.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200612-0411",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_1b44_a121_02_10"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_2444_a124_02_11_f"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_2444_a124_02_11"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_2444_a124_02_11_h"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_1b44_a121_02_10_p"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_2444_a124_02_11_g"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_1b44_a121_02_10_s"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_2444_a124_02_01"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_1b44_a121_02_10_q"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "p_2444_a124_02_00"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "p_1b44_a121_02_00"
},
{
"model": "directory server 2",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "p_1b44_a121_02_01"
},
{
"model": "directory server 2",
"scope": "lt",
"trust": 0.8,
"vendor": "hitachi",
"version": "02-11-/k"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "directory server version p-2444-a124 02-11-/h",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "2"
},
{
"model": "directory server version p-2444-a124 02-11-/g",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "2"
},
{
"model": "directory server version p-2444-a124 02-11-/f",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "2"
},
{
"model": "directory server version p-2444-a124",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "202-11"
},
{
"model": "directory server version p-2444-a124",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "202-01"
},
{
"model": "directory server version p-2444-a124",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "202-00"
},
{
"model": "directory server version p-1b44-a121 02-10-/s",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "2"
},
{
"model": "directory server version p-1b44-a121 02-10-/q",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "2"
},
{
"model": "directory server version p-1b44-a121 02-10-/p",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "2"
},
{
"model": "directory server version p-1b44-a121",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "202-10"
},
{
"model": "directory server version p-1b44-a121",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "202-01"
},
{
"model": "directory server version p-1b44-a121",
"scope": "eq",
"trust": 0.3,
"vendor": "hitachi",
"version": "202-00"
},
{
"model": "directory server version p-2444-a124 02-11-/k",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": "2"
},
{
"model": "directory server version p-2444-a121",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": "202-10-/v"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-9290"
},
{
"db": "BID",
"id": "21692"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_2444_a124_02_00:*:windows:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_2444_a124_02_01:*:windows:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_1b44_a121_02_01:*:hp_ux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_1b44_a121_02_10:*:hp_ux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_1b44_a121_02_10_p:*:hp_ux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_2444_a124_02_11_g:*:windows:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_2444_a124_02_11_h:*:windows:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_1b44_a121_02_10_q:*:hp_ux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_1b44_a121_02_10_s:*:hp_ux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_1b44_a121_02_00:*:hp_ux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_2444_a124_02_11:*:windows:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:hitachi_directory_server_2:p_2444_a124_02_11_f:*:windows:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6713"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hitachi",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
],
"trust": 0.6
},
"cve": "CVE-2006-6713",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2006-6713",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-6713",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200612-489",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allows remote attackers to execute arbitrary code via crafted LDAP requests. Hitachi Directory Server is a directory server launched by Hitachi. \n\n----------------------------------------------------------------------\n\nSecunia is proud to announce the availability of the Secunia Software\nInspector. \n\nThe Secunia Software Inspector is a free service that detects insecure\nversions of software that you may have installed in your system. When\ninsecure versions are detected, the Secunia Software Inspector also\nprovides thorough guidelines for updating the software to the latest\nsecure version from the vendor. \n\nTry it out online:\nhttp://secunia.com/software_inspector/\n\n----------------------------------------------------------------------\n\nTITLE:\nHitachi Directory Server LDAP Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA23421\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/23421/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom local network\n\nSOFTWARE:\nHitachi Directory Server 2.x\nhttp://secunia.com/product/4505/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Hitachi Directory Server,\nwhich can be exploited by malicious people to cause a DoS (Denial of\nService) or compromise a vulnerable system. \n\nThe vulnerabilities are reported in version 2. Prior versions may\nalso be affected. \n\nSOLUTION:\nUpdate to version 02-11-/K (Windows) or 02-10-/V (HP-UX). \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nhttp://www.hitachi-support.com/security_e/vuls_e/HS06-018_e/index-e.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"db": "CNVD",
"id": "CNVD-2006-9290"
},
{
"db": "BID",
"id": "21692"
},
{
"db": "PACKETSTORM",
"id": "53146"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-6713",
"trust": 3.3
},
{
"db": "HITACHI",
"id": "HS06-018",
"trust": 2.0
},
{
"db": "BID",
"id": "21692",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "23421",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2006-5098",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002634",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2006-9290",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200612-489",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "53146",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-9290"
},
{
"db": "BID",
"id": "21692"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"db": "PACKETSTORM",
"id": "53146"
},
{
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
]
},
"id": "VAR-200612-0411",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-9290"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-9290"
}
]
},
"last_update_date": "2023-12-18T12:59:10.193000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HS06-018",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/pdf/hs06-018.pdf"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-002634"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6713"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://secunia.com/advisories/23421"
},
{
"trust": 1.6,
"url": "http://www.hitachi-support.com/security_e/vuls_e/hs06-018_e/01-e.html"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/21692"
},
{
"trust": 1.0,
"url": "http://www.vupen.com/english/advisories/2006/5098"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-6713"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-6713"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/5098"
},
{
"trust": 0.4,
"url": "http://www.hitachi-support.com/security_e/vuls_e/hs06-018_e/index-e.html"
},
{
"trust": 0.3,
"url": "http://www.hitachi.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/software_inspector/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/23421/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4505/"
}
],
"sources": [
{
"db": "BID",
"id": "21692"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"db": "PACKETSTORM",
"id": "53146"
},
{
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2006-9290"
},
{
"db": "BID",
"id": "21692"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"db": "PACKETSTORM",
"id": "53146"
},
{
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-12-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-9290"
},
{
"date": "2006-12-21T00:00:00",
"db": "BID",
"id": "21692"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"date": "2006-12-21T21:14:31",
"db": "PACKETSTORM",
"id": "53146"
},
{
"date": "2006-12-23T01:28:00",
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"date": "2006-12-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-12-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-9290"
},
{
"date": "2016-07-06T14:40:00",
"db": "BID",
"id": "21692"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-002634"
},
{
"date": "2011-03-08T02:46:50.220000",
"db": "NVD",
"id": "CVE-2006-6713"
},
{
"date": "2007-01-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hitachi Directory Server LDAP Request Multiple Security Vulnerabilities",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-9290"
},
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200612-489"
}
],
"trust": 0.6
}
}
VAR-200712-0406
Vulnerability from variot - Updated: 2023-12-18 12:58Gesytec Easylon OPC Server before 2.3.44 does not properly validate server handles, which allows remote attackers to execute arbitrary code or cause a denial of service via unspecified network traffic to the OLE for Process Control (OPC) interface, probably related to free operations on arbitrary memory addresses through certain Remove functions, and read and write operations on arbitrary memory addresses through certain Set, Read, and Write functions. Gesytec Easylon OPC Server Does not properly validate the server handle, so arbitrary code may be executed or denial of service (DoS) There is a vulnerability that will be in a state. Easylon OPC Server is a system control server software used in the field of industrial automation. This issue affects versions prior to Easylon OPC Server 2.3.44.
2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published
How do you know which Secunia advisories are important to you?
The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively.
The vulnerability is caused due to an error when validating server handles and can be exploited to e.g.
SOLUTION: Update to version 2.3.44 or later. ftp://ftp.gesytec.de/pub/opc/
PROVIDED AND/OR DISCOVERED BY: Neutralbit
ORIGINAL ADVISORY: VU#205073: http://www.kb.cert.org/vuls/id/205073
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200712-0406",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "opc server",
"scope": "eq",
"trust": 1.6,
"vendor": "gesytec easylon",
"version": "2.30.32"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "gesytec",
"version": null
},
{
"model": "opc server",
"scope": "lt",
"trust": 0.8,
"vendor": "gesytec easylon",
"version": "2.3.44"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "opc server",
"version": "2.30.32"
},
{
"model": "easylon opc server",
"scope": "eq",
"trust": 0.3,
"vendor": "gesytec",
"version": "2.30.32"
},
{
"model": "easylon opc server",
"scope": "eq",
"trust": 0.3,
"vendor": "gesytec",
"version": "2.0"
},
{
"model": "easylon opc server",
"scope": "ne",
"trust": 0.3,
"vendor": "gesytec",
"version": "2.3.44"
}
],
"sources": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#205073"
},
{
"db": "CNVD",
"id": "CNVD-2007-7002"
},
{
"db": "BID",
"id": "26876"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gesytec_easylon:opc_server:2.30.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4473"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NeutralBit http://www.neutralbit.com/",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
],
"trust": 0.6
},
"cve": "CVE-2007-4473",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2007-4473",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "18d7792a-2352-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-4473",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#205073",
"trust": 0.8,
"value": "4.50"
},
{
"author": "CNNVD",
"id": "CNNVD-200712-200",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#205073"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Gesytec Easylon OPC Server before 2.3.44 does not properly validate server handles, which allows remote attackers to execute arbitrary code or cause a denial of service via unspecified network traffic to the OLE for Process Control (OPC) interface, probably related to free operations on arbitrary memory addresses through certain Remove functions, and read and write operations on arbitrary memory addresses through certain Set, Read, and Write functions. Gesytec Easylon OPC Server Does not properly validate the server handle, so arbitrary code may be executed or denial of service (DoS) There is a vulnerability that will be in a state. Easylon OPC Server is a system control server software used in the field of industrial automation. \nThis issue affects versions prior to Easylon OPC Server 2.3.44. \n\n----------------------------------------------------------------------\n\n2003: 2,700 advisories published\n2004: 3,100 advisories published\n2005: 4,600 advisories published\n2006: 5,300 advisories published\n\nHow do you know which Secunia advisories are important to you?\n\nThe Secunia Vulnerability Intelligence Solutions allows you to filter\nand structure all the information you need, so you can address issues\neffectively. \n\nThe vulnerability is caused due to an error when validating server\nhandles and can be exploited to e.g. \n\nSOLUTION:\nUpdate to version 2.3.44 or later. \nftp://ftp.gesytec.de/pub/opc/\n\nPROVIDED AND/OR DISCOVERED BY:\nNeutralbit\n\nORIGINAL ADVISORY:\nVU#205073:\nhttp://www.kb.cert.org/vuls/id/205073\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"db": "CERT/CC",
"id": "VU#205073"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"db": "CNVD",
"id": "CNVD-2007-7002"
},
{
"db": "BID",
"id": "26876"
},
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "61853"
}
],
"trust": 3.6
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-4473",
"trust": 3.7
},
{
"db": "CERT/CC",
"id": "VU#205073",
"trust": 3.6
},
{
"db": "BID",
"id": "26876",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "28079",
"trust": 1.8
},
{
"db": "OSVDB",
"id": "42650",
"trust": 1.6
},
{
"db": "CNVD",
"id": "CNVD-2007-7002",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002540",
"trust": 0.8
},
{
"db": "XF",
"id": "39062",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "11286",
"trust": 0.6
},
{
"db": "IVD",
"id": "7D75B1DE-463F-11E9-A03E-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "18D7792A-2352-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "61853",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#205073"
},
{
"db": "CNVD",
"id": "CNVD-2007-7002"
},
{
"db": "BID",
"id": "26876"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"db": "PACKETSTORM",
"id": "61853"
},
{
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
]
},
"id": "VAR-200712-0406",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2007-7002"
}
],
"trust": 0.1
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2007-7002"
}
]
},
"last_update_date": "2023-12-18T12:58:58.638000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.gesytec.de/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"db": "NVD",
"id": "CVE-2007-4473"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://www.kb.cert.org/vuls/id/205073"
},
{
"trust": 2.4,
"url": "http://www.neutralbit.com/en/rd/opctest/"
},
{
"trust": 1.6,
"url": "http://osvdb.org/42650"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/28079"
},
{
"trust": 1.6,
"url": "http://www.neutralbit.com/downloads/nb-nb-001-ext-opc%20security%20testing.pdf"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/26876"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39062"
},
{
"trust": 0.8,
"url": "ftp://ftp.gesytec.de/pub/opc/"
},
{
"trust": 0.8,
"url": "http://www.cpni.gov.uk/docs/re-20050223-00157.pdf"
},
{
"trust": 0.8,
"url": "http://www.opcfoundation.org/default.aspx/01_about/01_whatis.asp?mid=aboutopc"
},
{
"trust": 0.8,
"url": "http://en.wikipedia.org/wiki/ole_for_process_control"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4473"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-4473"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/39062"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/11286"
},
{
"trust": 0.3,
"url": "http://www.gesytec.de/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/28079/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/16967/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#205073"
},
{
"db": "BID",
"id": "26876"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"db": "PACKETSTORM",
"id": "61853"
},
{
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#205073"
},
{
"db": "CNVD",
"id": "CNVD-2007-7002"
},
{
"db": "BID",
"id": "26876"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"db": "PACKETSTORM",
"id": "61853"
},
{
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-12-14T00:00:00",
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"date": "2007-12-14T00:00:00",
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"date": "2007-12-14T00:00:00",
"db": "CERT/CC",
"id": "VU#205073"
},
{
"date": "2007-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-7002"
},
{
"date": "2007-12-14T00:00:00",
"db": "BID",
"id": "26876"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"date": "2007-12-18T00:56:59",
"db": "PACKETSTORM",
"id": "61853"
},
{
"date": "2007-12-17T21:46:00",
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"date": "2007-12-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-01-10T00:00:00",
"db": "CERT/CC",
"id": "VU#205073"
},
{
"date": "2007-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-7002"
},
{
"date": "2007-12-17T21:01:00",
"db": "BID",
"id": "26876"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002540"
},
{
"date": "2017-07-29T01:32:57.787000",
"db": "NVD",
"id": "CVE-2007-4473"
},
{
"date": "2007-12-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Easylon OPC Server Arbitrary code execution vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2007-7002"
},
{
"db": "BID",
"id": "26876"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
],
"trust": 1.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "7d75b1de-463f-11e9-a03e-000c29342cb1"
},
{
"db": "IVD",
"id": "18d7792a-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-200712-200"
}
],
"trust": 1.0
}
}
VAR-200408-0066
Vulnerability from variot - Updated: 2023-12-18 12:53Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed for the HTTP interface, which could allow remote attackers to gain unauthorized access. Zoom Model 5560 X3 is an EHTERNET ADSL modem.
The Zoom Model 5560 X3 has a default backdoor account, and remote attackers can use this vulnerability to control this device. Attackers can use this vulnerability to control the device. A remote attacker can gain unauthorized access to the vulnerable appliance and then carry out other attacks against the users of the network
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200408-0066",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "model 5560 x3 ethernet adsl modem",
"scope": "eq",
"trust": 1.0,
"vendor": "zoom",
"version": "*"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "model 5560 x3 ethernet adsl modem",
"scope": null,
"trust": 0.6,
"vendor": "zoom",
"version": null
},
{
"model": "model ethernet adsl modem",
"scope": "eq",
"trust": 0.3,
"vendor": "zoom",
"version": "5560x3"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1949"
},
{
"db": "BID",
"id": "10669"
},
{
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:zoom:model_5560_x3_ethernet_adsl_modem:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0680"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adam Laurie\u203b adam@algroup.co.uk",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
],
"trust": 0.6
},
"cve": "CVE-2004-0680",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-9110",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2004-0680",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200408-090",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-9110",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9110"
},
{
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed for the HTTP interface, which could allow remote attackers to gain unauthorized access. Zoom Model 5560 X3 is an EHTERNET ADSL modem. \n\r\n\r\n The Zoom Model 5560 X3 has a default backdoor account, and remote attackers can use this vulnerability to control this device. Attackers can use this vulnerability to control the device. \nA remote attacker can gain unauthorized access to the vulnerable appliance and then carry out other attacks against the users of the network",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"db": "CNVD",
"id": "CNVD-2004-1949"
},
{
"db": "BID",
"id": "10669"
},
{
"db": "VULHUB",
"id": "VHN-9110"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2004-0680",
"trust": 2.6
},
{
"db": "BID",
"id": "10669",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2004-1949",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040706 BACKDOOR MENU ON CONEXANT CHIPSET DSL ROUTER (ZOOM X3)",
"trust": 0.6
},
{
"db": "XF",
"id": "16639",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-9110",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1949"
},
{
"db": "VULHUB",
"id": "VHN-9110"
},
{
"db": "BID",
"id": "10669"
},
{
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
]
},
"id": "VAR-200408-0066",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-9110"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:53:46.993000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0680"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/10669"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16639"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=108915255520924\u0026w=2"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/16639"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=108915255520924\u0026w=2"
},
{
"trust": 0.3,
"url": "http://www.zoom.com/"
},
{
"trust": 0.3,
"url": "/archive/1/368118"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=108915255520924\u0026amp;w=2"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9110"
},
{
"db": "BID",
"id": "10669"
},
{
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2004-1949"
},
{
"db": "VULHUB",
"id": "VHN-9110"
},
{
"db": "BID",
"id": "10669"
},
{
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-07-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-1949"
},
{
"date": "2004-08-06T00:00:00",
"db": "VULHUB",
"id": "VHN-9110"
},
{
"date": "2004-07-06T00:00:00",
"db": "BID",
"id": "10669"
},
{
"date": "2004-08-06T04:00:00",
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"date": "2004-07-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-03-10T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-1949"
},
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-9110"
},
{
"date": "2009-07-12T06:16:00",
"db": "BID",
"id": "10669"
},
{
"date": "2017-07-11T01:30:22.417000",
"db": "NVD",
"id": "CVE-2004-0680"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zoom Model 5560 X3 Ethernet ADSL Modem default backdoor account vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1949"
},
{
"db": "BID",
"id": "10669"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
],
"trust": 1.5
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "10669"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-090"
}
],
"trust": 0.9
}
}
VAR-200412-1004
Vulnerability from variot - Updated: 2023-12-18 12:53Motorola Wireless Router WR850G running firmware 4.03 allows remote attackers to bypass authentication, log on as an administrator, and obtain sensitive information by repeatedly making an HTTP request for ver.asp until an administrator logs on. Motorola WR850G is a wireless router.
The attacker gains access to the WEB interface through periodic access restricted 'ver.asp' scripts, and can obtain the WEB interface user name and password. Using this password, by accessing frame_debug.asp, the WEB SHELL can be obtained and executed on the system. Any command. This issue is caused by a design error and may allow an attacker to ultimately take complete control over the device. Motorola wireless router WR850G running firmware version 4.03 is reportedly affected by this issue. It is possible that other models and firmware versions are affected as well
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200412-1004",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wr850g",
"scope": "eq",
"trust": 1.6,
"vendor": "motorola",
"version": "4.0.3_firmware"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "wr850g",
"scope": "eq",
"trust": 0.3,
"vendor": "motorola",
"version": "4.03"
},
{
"model": "wr850g",
"scope": "ne",
"trust": 0.3,
"vendor": "motorola",
"version": "5.13"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-2618"
},
{
"db": "BID",
"id": "11241"
},
{
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:motorola:wr850g:4.0.3_firmware:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-1550"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Fabian\u203b d.fabian@sec-consult.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
],
"trust": 0.6
},
"cve": "CVE-2004-1550",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-9980",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2004-1550",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200412-222",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-9980",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9980"
},
{
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Motorola Wireless Router WR850G running firmware 4.03 allows remote attackers to bypass authentication, log on as an administrator, and obtain sensitive information by repeatedly making an HTTP request for ver.asp until an administrator logs on. Motorola WR850G is a wireless router. \n\n\u00a0The attacker gains access to the WEB interface through periodic access restricted \u0027ver.asp\u0027 scripts, and can obtain the WEB interface user name and password. Using this password, by accessing frame_debug.asp, the WEB SHELL can be obtained and executed on the system. Any command. This issue is caused by a design error and may allow an attacker to ultimately take complete control over the device. \nMotorola wireless router WR850G running firmware version 4.03 is reportedly affected by this issue. It is possible that other models and firmware versions are affected as well",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"db": "CNVD",
"id": "CNVD-2004-2618"
},
{
"db": "BID",
"id": "11241"
},
{
"db": "VULHUB",
"id": "VHN-9980"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2004-1550",
"trust": 2.6
},
{
"db": "BID",
"id": "11241",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2004-2618",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "6955",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040924 MOTOROLA WIRELESS ROUTER WR850G AUTHENTICATION CIRCUMVENTION",
"trust": 0.6
},
{
"db": "XF",
"id": "850",
"trust": 0.6
},
{
"db": "XF",
"id": "17474",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20040923 MOTOROLA WIRELESS ROUTER WR850G AUTHENTICATION CIRCUMVENTION",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-9980",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-2618"
},
{
"db": "VULHUB",
"id": "VHN-9980"
},
{
"db": "BID",
"id": "11241"
},
{
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
]
},
"id": "VAR-200412-1004",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-9980"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:53:45.328000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-1550"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/11241"
},
{
"trust": 1.7,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-september/026791.html"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17474"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=109613135105800\u0026w=2"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/17474"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=109613135105800\u0026w=2"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/6955"
},
{
"trust": 0.3,
"url": "http://broadband.motorola.com/consumers/products/wr850g/"
},
{
"trust": 0.3,
"url": "/archive/1/376384"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=109613135105800\u0026amp;w=2"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9980"
},
{
"db": "BID",
"id": "11241"
},
{
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2004-2618"
},
{
"db": "VULHUB",
"id": "VHN-9980"
},
{
"db": "BID",
"id": "11241"
},
{
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-09-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-2618"
},
{
"date": "2004-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-9980"
},
{
"date": "2004-09-23T00:00:00",
"db": "BID",
"id": "11241"
},
{
"date": "2004-12-31T05:00:00",
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"date": "2004-09-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-09-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-2618"
},
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-9980"
},
{
"date": "2009-07-12T07:06:00",
"db": "BID",
"id": "11241"
},
{
"date": "2017-07-11T01:31:08.107000",
"db": "NVD",
"id": "CVE-2004-1550"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Motorola WR850G Wireless Router Remote Authentication Bypass Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-2618"
},
{
"db": "BID",
"id": "11241"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
],
"trust": 1.5
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "11241"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-222"
}
],
"trust": 0.9
}
}
VAR-201208-0268
Vulnerability from variot - Updated: 2023-12-18 12:52Unspecified vulnerability in Hitachi Cobol GUI Option 06-00, 06-01 through 06-01-/A, 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B and Cobol GUI Option Server 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B allows remote attackers to execute arbitrary code via unknown attack vectors. This problem does not occur when only the following runtime products are solely used. HITACHI COBOL is an integrated development environment. No detailed details are provided at this time. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: Hitachi COBOL GUI Run Time System Code Execution Vulnerability
SECUNIA ADVISORY ID: SA49158
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49158/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49158
RELEASE DATE: 2012-05-14
DISCUSS ADVISORY: http://secunia.com/advisories/49158/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/49158/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=49158
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: A vulnerability has been reported in Hitachi COBOL GUI Run Time System and Hitachi COBOL Server GUI Run Time System, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to an unspecified error. No further information is currently available.
The vulnerability is reported in versions 06-00, 06-01 through 06-01-/A, 07-00, 07-01 through 07-01-/A, and 08-00 through 08-00-/A.
SOLUTION: Update or upgrade to version 07-01-/B or 08-00-/B.
PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.
ORIGINAL ADVISORY: HS12-013: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-013/index.html
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201208-0268",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cobol gui option server",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "08-00"
},
{
"model": "cobol gui option server",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "07-01"
},
{
"model": "cobol gui option server",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "07-00"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "08-00"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "07-01"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.9,
"vendor": "hitachi",
"version": "07-00"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "08-00\\/a"
},
{
"model": "cobol gui option server",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "08-00\\/a"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "06-01\\/a"
},
{
"model": "cobol gui option server",
"scope": "eq",
"trust": 1.6,
"vendor": "hitachi",
"version": "07-01\\/a"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.3,
"vendor": "hitachi",
"version": "06-01"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.3,
"vendor": "hitachi",
"version": "06-00"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 1.0,
"vendor": "hitachi",
"version": "07-01\\/a"
},
{
"model": "cobol gui server run time system",
"scope": "eq",
"trust": 0.9,
"vendor": "hitachi",
"version": "07-01"
},
{
"model": "cobol gui server run time system",
"scope": "eq",
"trust": 0.9,
"vendor": "hitachi",
"version": "08-00"
},
{
"model": "cobol gui server run time system 08-00-/a",
"scope": null,
"trust": 0.9,
"vendor": "hitachi",
"version": null
},
{
"model": "cobol gui server run time system",
"scope": "eq",
"trust": 0.9,
"vendor": "hitachi",
"version": "07-00"
},
{
"model": "cobol gui server run time system 07-01-/a",
"scope": null,
"trust": 0.9,
"vendor": "hitachi",
"version": null
},
{
"model": "cobol gui run time system",
"scope": "eq",
"trust": 0.9,
"vendor": "hitachi",
"version": "07-00"
},
{
"model": "cobol gui run time system",
"scope": "eq",
"trust": 0.9,
"vendor": "hitachi",
"version": "07-01"
},
{
"model": "cobol gui run time system 07-01-/a",
"scope": null,
"trust": 0.9,
"vendor": "hitachi",
"version": null
},
{
"model": "cobol gui run time system",
"scope": "eq",
"trust": 0.9,
"vendor": "hitachi",
"version": "08-00"
},
{
"model": "cobol gui run time system 08-00-/a",
"scope": null,
"trust": 0.9,
"vendor": "hitachi",
"version": null
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "(windows)"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "server (windows)"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "server version 7 (windows)"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "version 6 (windows)"
},
{
"model": "cobol gui option",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "version 7 (windows)"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "cobol gui server run time system 08-00-/b",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": null
},
{
"model": "cobol gui server run time system 07-01-/b",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": null
},
{
"model": "cobol gui run time system 08-00-/b",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": null
},
{
"model": "cobol gui run time system 07-01-/b",
"scope": "ne",
"trust": 0.3,
"vendor": "hitachi",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"db": "BID",
"id": "78127"
},
{
"db": "BID",
"id": "53506"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:06-01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:07-01\\/a:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option_server:07-01\\/a:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option_server:08-00\\/a:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:07-01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:08-00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:08-00\\/a:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option_server:07-00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:06-00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:06-01\\/a:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option:07-00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option_server:07-01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:hitachi:cobol_gui_option_server:08-00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-4274"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "78127"
}
],
"trust": 0.3
},
"cve": "CVE-2012-4274",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "VENDOR",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2012-002377",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2012-8815",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-4274",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "VENDOR",
"id": "JVNDB-2012-002377",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2012-8815",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201208-179",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unspecified vulnerability in Hitachi Cobol GUI Option 06-00, 06-01 through 06-01-/A, 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B and Cobol GUI Option Server 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B allows remote attackers to execute arbitrary code via unknown attack vectors. This problem does not occur when only the following runtime products are solely used. HITACHI COBOL is an integrated development environment. No detailed details are provided at this time. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nHitachi COBOL GUI Run Time System Code Execution Vulnerability\n\nSECUNIA ADVISORY ID:\nSA49158\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/49158/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49158\n\nRELEASE DATE:\n2012-05-14\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/49158/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/49158/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49158\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in Hitachi COBOL GUI Run Time\nSystem and Hitachi COBOL Server GUI Run Time System, which can be\nexploited by malicious people to compromise a user\u0027s system. \n\nThe vulnerability is caused due to an unspecified error. No further\ninformation is currently available. \n\nThe vulnerability is reported in versions 06-00, 06-01 through\n06-01-/A, 07-00, 07-01 through 07-01-/A, and 08-00 through 08-00-/A. \n\nSOLUTION:\nUpdate or upgrade to version 07-01-/B or 08-00-/B. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nHS12-013:\nhttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-013/index.html\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"db": "BID",
"id": "78127"
},
{
"db": "BID",
"id": "53506"
},
{
"db": "PACKETSTORM",
"id": "112713"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-4274",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "49158",
"trust": 2.4
},
{
"db": "HITACHI",
"id": "HS12-013",
"trust": 2.3
},
{
"db": "BID",
"id": "53506",
"trust": 1.5
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2012-8815",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2012-2534",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201205-230",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201208-179",
"trust": 0.6
},
{
"db": "BID",
"id": "78127",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "112713",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"db": "BID",
"id": "78127"
},
{
"db": "BID",
"id": "53506"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"db": "PACKETSTORM",
"id": "112713"
},
{
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-230"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
]
},
"id": "VAR-201208-0268",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
}
],
"trust": 1.95
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.2
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
}
]
},
"last_update_date": "2023-12-18T12:52:16.751000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HS12-013",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-013/index.html"
},
{
"title": "Patch for Hitachi COBOL GUI Run Time System Unknown Remote Code Execution Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/36009"
},
{
"title": "Patch for Hitachi COBOL GUI Run Time System code execution vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/16955"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-4274"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs12-013/index.html"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/49158"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/53506"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4274"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4274"
},
{
"trust": 0.7,
"url": "http://secunia.com/advisories/49158/"
},
{
"trust": 0.3,
"url": "http://www.hitachi.com"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/49158/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=49158"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"db": "BID",
"id": "78127"
},
{
"db": "BID",
"id": "53506"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"db": "PACKETSTORM",
"id": "112713"
},
{
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-230"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"db": "BID",
"id": "78127"
},
{
"db": "BID",
"id": "53506"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"db": "PACKETSTORM",
"id": "112713"
},
{
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-230"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"date": "2012-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"date": "2012-08-13T00:00:00",
"db": "BID",
"id": "78127"
},
{
"date": "2012-05-14T00:00:00",
"db": "BID",
"id": "53506"
},
{
"date": "2012-05-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"date": "2012-05-14T07:11:25",
"db": "PACKETSTORM",
"id": "112713"
},
{
"date": "2012-08-13T22:55:01.630000",
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"date": "2012-05-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-230"
},
{
"date": "2012-08-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"date": "2012-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-2534"
},
{
"date": "2012-08-13T00:00:00",
"db": "BID",
"id": "78127"
},
{
"date": "2012-05-14T00:00:00",
"db": "BID",
"id": "53506"
},
{
"date": "2012-05-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-002377"
},
{
"date": "2012-08-14T04:00:00",
"db": "NVD",
"id": "CVE-2012-4274"
},
{
"date": "2012-05-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201205-230"
},
{
"date": "2012-08-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201205-230"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-179"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Hitachi COBOL GUI Run Time System Unknown Remote Code Execution Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-8815"
},
{
"db": "CNNVD",
"id": "CNNVD-201205-230"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Failure to Handle Exceptional Conditions",
"sources": [
{
"db": "BID",
"id": "78127"
}
],
"trust": 0.3
}
}
VAR-199903-0037
Vulnerability from variot - Updated: 2023-12-18 12:47Cisco Catalyst LAN switches running Catalyst 5000 supervisor software allows remote attackers to perform a denial of service by forcing the supervisor module to reload. Cisco Catalyst is a widely used switch product developed by Cisco.
A remote attacker may connect to the TCP 7161 port of the affected switch, causing the management module to reload. At this time, the switch will not forward the packet. Although the switch can automatically recover and forward the packet afterwards, the attacker can continue to attack and form Denial of service attack
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-199903-0037",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "catalyst 29xx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.1.5"
},
{
"model": "catalyst 29xx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.1.502"
},
{
"model": "catalyst 5xxx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.1.502"
},
{
"model": "catalyst 29xx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "1.0"
},
{
"model": "catalyst 5xxx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.1.5"
},
{
"model": "catalyst 29xx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.1.501"
},
{
"model": "catalyst 5xxx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "1.0"
},
{
"model": "catalyst 5xxx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.1.501"
},
{
"model": "catalyst 12xx supervisor software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.29"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 12xx supervisor",
"version": "4.29"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 29xx supervisor",
"version": "1.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 29xx supervisor",
"version": "2.1.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 29xx supervisor",
"version": "2.1.501"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 29xx supervisor",
"version": "2.1.502"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 5xxx supervisor",
"version": "1.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 5xxx supervisor",
"version": "2.1.5"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 5xxx supervisor",
"version": "2.1.501"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "catalyst 5xxx supervisor",
"version": "2.1.502"
}
],
"sources": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_29xx_supervisor_software:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_29xx_supervisor_software:2.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_29xx_supervisor_software:2.1.501:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_29xx_supervisor_software:2.1.502:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_12xx_supervisor_software:4.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_5xxx_supervisor_software:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_5xxx_supervisor_software:2.1.501:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_5xxx_supervisor_software:2.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:catalyst_5xxx_supervisor_software:2.1.502:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-1999-0430"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
],
"trust": 0.6
},
"cve": "CVE-1999-0430",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-430",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-1999-0430",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-199903-011",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-430",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-430"
},
{
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Catalyst LAN switches running Catalyst 5000 supervisor software allows remote attackers to perform a denial of service by forcing the supervisor module to reload. Cisco Catalyst is a widely used switch product developed by Cisco. \n\n\u00a0A remote attacker may connect to the TCP 7161 port of the affected switch, causing the management module to reload. At this time, the switch will not forward the packet. Although the switch can automatically recover and forward the packet afterwards, the attacker can continue to attack and form Denial of service attack",
"sources": [
{
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-430"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-1999-0430",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "1103",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-1999-0447",
"trust": 0.8
},
{
"db": "IVD",
"id": "193B08E6-23CF-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-430",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"db": "VULHUB",
"id": "VHN-430"
},
{
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
]
},
"id": "VAR-199903-0037",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"db": "VULHUB",
"id": "VHN-430"
}
],
"trust": 0.09
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-1999-0447"
}
]
},
"last_update_date": "2023-12-18T12:47:42.832000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-1999-0430"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.osvdb.org/1103"
},
{
"trust": 0.1,
"url": ""
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-430"
},
{
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"db": "VULHUB",
"id": "VHN-430"
},
{
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "1999-01-01T00:00:00",
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"date": "1999-01-01T00:00:00",
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"date": "1999-03-01T00:00:00",
"db": "VULHUB",
"id": "VHN-430"
},
{
"date": "1999-03-01T05:00:00",
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"date": "1997-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "1999-01-01T00:00:00",
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"date": "2008-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-430"
},
{
"date": "2008-09-09T12:34:31.680000",
"db": "NVD",
"id": "CVE-1999-0430"
},
{
"date": "2005-05-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Catalyst Switch Remote Denial of Service Attack Vulnerability",
"sources": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-1999-0447"
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "unknown",
"sources": [
{
"db": "IVD",
"id": "193b08e6-23cf-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-199903-011"
}
],
"trust": 0.8
}
}
VAR-200602-0268
Vulnerability from variot - Updated: 2023-12-18 12:47D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP service crash) via a request composed of "GET" followed by a space and two newlines, possibly triggering the crash due to missing arguments. D-Link DWL-G700AP is a wireless access router.
D-Link DWL-G700AP's HTTP management interface implementation has a vulnerability. A remote attacker could use this vulnerability to cause the HTTP server to become unresponsive.
If you want to configure DWL-G700AP, you must go through the http service, and this service is managed by httpd named CAMEO. A denial of service vulnerability exists in this webserver. An attacker just sending a "GET \ n \ n" string can cause the service to crash. D-Link DWL-G700AP HTTPD is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the 'httpd' service to properly handle malformed data. An attacker can exploit this issue to crash the affected webserver, effectively denying service to legitimate users. The affected device must be manually reset to restart the affected service. This issue is reported to affect firmware versions 2.00 and 2.01; other firmware versions may also be vulnerable.
TITLE: DWL-G700AP Web Interface Denial of Service
SECUNIA ADVISORY ID: SA18932
VERIFY ADVISORY: http://secunia.com/advisories/18932/
CRITICAL: Less critical
IMPACT: DoS
WHERE:
From local network
OPERATING SYSTEM: D-Link DWL-G700AP http://secunia.com/product/8121/
DESCRIPTION: l0om has reported a vulnerability in D-Link DWL-G700AP, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error in the web-based management interface and can be exploited to crash the service via a malformed HTTP request with no resource specified.
SOLUTION: Restrict access to the web interface.
PROVIDED AND/OR DISCOVERED BY: l0om
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200602-0268",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dwl-g700ap",
"scope": "eq",
"trust": 1.9,
"vendor": "d link",
"version": "2.01"
},
{
"model": "dwl-g700ap",
"scope": "eq",
"trust": 1.9,
"vendor": "d link",
"version": "2.00"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"db": "BID",
"id": "16690"
},
{
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dwl-g700ap:2.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:d-link:dwl-g700ap:2.01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0784"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "l0om l0om@excluded.org",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
],
"trust": 0.6
},
"cve": "CVE-2006-0784",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-16892",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-0784",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200602-294",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-16892",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-16892"
},
{
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP service crash) via a request composed of \"GET\" followed by a space and two newlines, possibly triggering the crash due to missing arguments. D-Link DWL-G700AP is a wireless access router. \n\n\u00a0D-Link DWL-G700AP\u0027s HTTP management interface implementation has a vulnerability. A remote attacker could use this vulnerability to cause the HTTP server to become unresponsive. \n\n\u00a0If you want to configure DWL-G700AP, you must go through the http service, and this service is managed by httpd named CAMEO. A denial of service vulnerability exists in this webserver. An attacker just sending a \"GET \\ n \\ n\" string can cause the service to crash. D-Link DWL-G700AP HTTPD is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the \u0027httpd\u0027 service to properly handle malformed data. \nAn attacker can exploit this issue to crash the affected webserver, effectively denying service to legitimate users. The affected device must be manually reset to restart the affected service. \nThis issue is reported to affect firmware versions 2.00 and 2.01; other firmware versions may also be vulnerable. \n\nTITLE:\nDWL-G700AP Web Interface Denial of Service\n\nSECUNIA ADVISORY ID:\nSA18932\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/18932/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nDoS\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nD-Link DWL-G700AP\nhttp://secunia.com/product/8121/\n\nDESCRIPTION:\nl0om has reported a vulnerability in D-Link DWL-G700AP, which can be\nexploited by malicious people to cause a DoS (Denial of Service). \n\nThe vulnerability is caused due to an error in the web-based\nmanagement interface and can be exploited to crash the service via a\nmalformed HTTP request with no resource specified. \n\nSOLUTION:\nRestrict access to the web interface. \n\nPROVIDED AND/OR DISCOVERED BY:\nl0om\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"db": "BID",
"id": "16690"
},
{
"db": "VULHUB",
"id": "VHN-16892"
},
{
"db": "PACKETSTORM",
"id": "43950"
}
],
"trust": 1.89
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-16892",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-16892"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-0784",
"trust": 2.3
},
{
"db": "BID",
"id": "16690",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "18932",
"trust": 1.8
},
{
"db": "SREASON",
"id": "441",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2006-0637",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200602-294",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2006-0922",
"trust": 0.6
},
{
"db": "XF",
"id": "24762",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20060216 D-LINK DWL-G700AP HTTPD DOS",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-80858",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "27241",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-16892",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "43950",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"db": "VULHUB",
"id": "VHN-16892"
},
{
"db": "BID",
"id": "16690"
},
{
"db": "PACKETSTORM",
"id": "43950"
},
{
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
]
},
"id": "VAR-200602-0268",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"db": "VULHUB",
"id": "VHN-16892"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-0922"
}
]
},
"last_update_date": "2023-12-18T12:47:09.728000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0784"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/16690"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/18932"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/441"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/425169/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/0637"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24762"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/425169/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/24762"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/0637"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/products/?pid=326"
},
{
"trust": 0.3,
"url": "http://www.d-link.com/"
},
{
"trust": 0.3,
"url": "/archive/1/425169"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/8121/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/18932/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-16892"
},
{
"db": "BID",
"id": "16690"
},
{
"db": "PACKETSTORM",
"id": "43950"
},
{
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"db": "VULHUB",
"id": "VHN-16892"
},
{
"db": "BID",
"id": "16690"
},
{
"db": "PACKETSTORM",
"id": "43950"
},
{
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-02-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"date": "2006-02-19T00:00:00",
"db": "VULHUB",
"id": "VHN-16892"
},
{
"date": "2006-02-16T00:00:00",
"db": "BID",
"id": "16690"
},
{
"date": "2006-02-17T23:46:33",
"db": "PACKETSTORM",
"id": "43950"
},
{
"date": "2006-02-19T11:02:00",
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"date": "2006-02-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-02-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"date": "2018-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-16892"
},
{
"date": "2006-02-17T02:42:00",
"db": "BID",
"id": "16690"
},
{
"date": "2018-10-18T16:29:04.320000",
"db": "NVD",
"id": "CVE-2006-0784"
},
{
"date": "2006-02-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DWL-G700AP httpd Remote Denial of Service Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-0922"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200602-294"
}
],
"trust": 0.6
}
}
VAR-200611-0508
Vulnerability from variot - Updated: 2023-12-18 12:46Stack-based buffer overflow in A5AGU.SYS 1.0.1.41 for the D-Link DWL-G132 wireless adapter allows remote attackers to execute arbitrary code via a 802.11 beacon request with a long Rates information element (IE). D-LINK DWL-G132 is a high performance 802.11g wireless network card.
D-Link DWL-G132 wireless network card A5AGU.SYS driver has a stack overflow vulnerability. A remote attacker may use this vulnerability to execute arbitrary instructions on the user's machine. Because the overflow is triggered by a beacon frame, all network cards in the attack range are affected. The D-Link Wireless Device Driver for DWL-G132 devices is prone to a stack-based buffer-overflow vulnerability because the driver fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. Exploiting this issue allows attackers to execute arbitrary machine code in the context of the kernel hosting the vulnerable driver. Failed attempts will likely crash the kernel, resulting in denial-of-service conditions. The ASAGU.SYS driver is primarily used on the Microsoft Window operating system. Note, however, that Linux and BSD machines using the 'ndiswrapper' tool should determine if they are using a vulnerable instance of the driver. Note also that this vulnerability can be exploited only when an attacker is within the range of broadcast of 802.11 wireless connections. Version 1.0.1.41 of the ASAGU.SYS driver is reported vulnerable; other versions may also be affected.
To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German.
The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios.
This includes: * Reason for rating * Extended description * Extended solution * Exploit code or links to exploit code * Deep links
Read the full description: http://corporate.secunia.com/products/48/?r=l
Contact Secunia Sales for more information: http://corporate.secunia.com/how_to_buy/15/?r=l
TITLE: D-Link DWL-G132 Wireless Driver Beacon Rates Buffer Overflow
SECUNIA ADVISORY ID: SA22860
VERIFY ADVISORY: http://secunia.com/advisories/22860/
CRITICAL: Moderately critical
IMPACT: System access
WHERE:
From remote
SOFTWARE: D-Link Wireless USB Network Adapter Driver 1.x http://secunia.com/product/12585/
DESCRIPTION: H D Moore has reported a vulnerability in D-Link DWL-G132 Wireless driver, which can be exploited by malicious people to compromise a vulnerable system. This can be exploited to cause a stack-based buffer overflow via a specially crafted packet.
PROVIDED AND/OR DISCOVERED BY: H D Moore
ORIGINAL ADVISORY: http://projects.info-pull.com/mokb/MOKB-13-11-2006.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200611-0508",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dwl-g132",
"scope": null,
"trust": 1.4,
"vendor": "d link",
"version": null
},
{
"model": "dwl-g132",
"scope": "eq",
"trust": 1.0,
"vendor": "d link",
"version": "*"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "dwl-g132",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "0"
},
{
"model": "asagu.sys",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.0.1.41"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-8432"
},
{
"db": "BID",
"id": "21032"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dwl-g132:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6055"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "H D Moore \u003chdm@metasploit.com\u003e is credited with the discovery of this vulnerability. Assistance was provided by Matt Miller \u003cmmiller@hick.org\u003e, Johnny Cache \u003cjohnnycsh@802.11mercenary.net\u003e, and LMH \u003clmh@info-pull.com\u003e.",
"sources": [
{
"db": "BID",
"id": "21032"
}
],
"trust": 0.3
},
"cve": "CVE-2006-6055",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2006-6055",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-22163",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-6055",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200611-334",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-22163",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2006-6055",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-22163"
},
{
"db": "VULMON",
"id": "CVE-2006-6055"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in A5AGU.SYS 1.0.1.41 for the D-Link DWL-G132 wireless adapter allows remote attackers to execute arbitrary code via a 802.11 beacon request with a long Rates information element (IE). D-LINK DWL-G132 is a high performance 802.11g wireless network card. \n\n\u00a0D-Link DWL-G132 wireless network card A5AGU.SYS driver has a stack overflow vulnerability. A remote attacker may use this vulnerability to execute arbitrary instructions on the user\u0027s machine. Because the overflow is triggered by a beacon frame, all network cards in the attack range are affected. The D-Link Wireless Device Driver for DWL-G132 devices is prone to a stack-based buffer-overflow vulnerability because the driver fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. \nExploiting this issue allows attackers to execute arbitrary machine code in the context of the kernel hosting the vulnerable driver. Failed attempts will likely crash the kernel, resulting in denial-of-service conditions. \nThe ASAGU.SYS driver is primarily used on the Microsoft Window operating system. Note, however, that Linux and BSD machines using the \u0027ndiswrapper\u0027 tool should determine if they are using a vulnerable instance of the driver. \nNote also that this vulnerability can be exploited only when an attacker is within the range of broadcast of 802.11 wireless connections. \nVersion 1.0.1.41 of the ASAGU.SYS driver is reported vulnerable; other versions may also be affected. \n\n----------------------------------------------------------------------\n\nTo improve our services to our customers, we have made a number of\nadditions to the Secunia Advisories and have started translating the\nadvisories to German. \n\nThe improvements will help our customers to get a better\nunderstanding of how we reached our conclusions, how it was rated,\nour thoughts on exploitation, attack vectors, and scenarios. \n\nThis includes:\n* Reason for rating\n* Extended description\n* Extended solution\n* Exploit code or links to exploit code\n* Deep links\n\nRead the full description:\nhttp://corporate.secunia.com/products/48/?r=l\n\nContact Secunia Sales for more information:\nhttp://corporate.secunia.com/how_to_buy/15/?r=l\n\n----------------------------------------------------------------------\n\nTITLE:\nD-Link DWL-G132 Wireless Driver Beacon Rates Buffer Overflow\n\nSECUNIA ADVISORY ID:\nSA22860\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/22860/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nD-Link Wireless USB Network Adapter Driver 1.x\nhttp://secunia.com/product/12585/\n\nDESCRIPTION:\nH D Moore has reported a vulnerability in D-Link DWL-G132 Wireless\ndriver, which can be exploited by malicious people to compromise a\nvulnerable system. This can be exploited to\ncause a stack-based buffer overflow via a specially crafted packet. \n\nPROVIDED AND/OR DISCOVERED BY:\nH D Moore\n\nORIGINAL ADVISORY:\nhttp://projects.info-pull.com/mokb/MOKB-13-11-2006.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"db": "CNVD",
"id": "CNVD-2006-8432"
},
{
"db": "BID",
"id": "21032"
},
{
"db": "VULHUB",
"id": "VHN-22163"
},
{
"db": "VULMON",
"id": "CVE-2006-6055"
},
{
"db": "PACKETSTORM",
"id": "52061"
}
],
"trust": 2.7
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-22163",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=2771",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-22163"
},
{
"db": "VULMON",
"id": "CVE-2006-6055"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-6055",
"trust": 3.5
},
{
"db": "BID",
"id": "21032",
"trust": 2.1
},
{
"db": "SECUNIA",
"id": "22860",
"trust": 1.9
},
{
"db": "SECTRACK",
"id": "1017215",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2006-4488",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001595",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200611-334",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2006-8432",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "2771",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-70903",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-22163",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2006-6055",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "52061",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-8432"
},
{
"db": "VULHUB",
"id": "VHN-22163"
},
{
"db": "VULMON",
"id": "CVE-2006-6055"
},
{
"db": "BID",
"id": "21032"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"db": "PACKETSTORM",
"id": "52061"
},
{
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
]
},
"id": "VAR-200611-0508",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-8432"
},
{
"db": "VULHUB",
"id": "VHN-22163"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-8432"
}
]
},
"last_update_date": "2023-12-18T12:46:57.125000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.dlink.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6055"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "http://projects.info-pull.com/mokb/mokb-13-11-2006.html"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/21032"
},
{
"trust": 1.8,
"url": "http://securitytracker.com/id?1017215"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/22860"
},
{
"trust": 1.2,
"url": "http://www.vupen.com/english/advisories/2006/4488"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-6055"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-6055"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/4488"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/products/?pid=358"
},
{
"trust": 0.3,
"url": "http://uninformed.org/index.cgi?v=6\u0026a=2"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/2771/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/22860/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/products/48/?r=l"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/12585/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/15/?r=l"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-22163"
},
{
"db": "VULMON",
"id": "CVE-2006-6055"
},
{
"db": "BID",
"id": "21032"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"db": "PACKETSTORM",
"id": "52061"
},
{
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2006-8432"
},
{
"db": "VULHUB",
"id": "VHN-22163"
},
{
"db": "VULMON",
"id": "CVE-2006-6055"
},
{
"db": "BID",
"id": "21032"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"db": "PACKETSTORM",
"id": "52061"
},
{
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-11-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-8432"
},
{
"date": "2006-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-22163"
},
{
"date": "2006-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2006-6055"
},
{
"date": "2006-11-13T00:00:00",
"db": "BID",
"id": "21032"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"date": "2006-11-16T03:19:38",
"db": "PACKETSTORM",
"id": "52061"
},
{
"date": "2006-11-22T01:07:00",
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"date": "2006-11-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-11-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-8432"
},
{
"date": "2011-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-22163"
},
{
"date": "2011-03-08T00:00:00",
"db": "VULMON",
"id": "CVE-2006-6055"
},
{
"date": "2016-07-06T13:33:00",
"db": "BID",
"id": "21032"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-001595"
},
{
"date": "2011-03-08T02:44:50.563000",
"db": "NVD",
"id": "CVE-2006-6055"
},
{
"date": "2006-12-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DWL-G132 Wireless adapter A5AGU.SYS Vulnerable to stack-based buffer overflow",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2006-001595"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200611-334"
}
],
"trust": 0.6
}
}
VAR-200611-0485
Vulnerability from variot - Updated: 2023-12-18 12:40Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via (1) beacon or (2) probe 802.11 frame responses with an long supported rates information element. NOTE: this issue was reported as a "memory corruption" error, but the associated exploit code suggests that it is a buffer overflow. A buffer overflow vulnerability exists in the Netgear MA521nd5.SYS wireless driver. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or cause a denial-of-service condition. NetGear MA521 is an 802.11b wireless PC network card.
If a malformed frame (beacon or probe response) is received in the active scan mode, the MA521nd5.SYS driver of the MA521 will attempt to write to a memory location controlled by the attacker. Failed attempts will likely crash the kernel, resulting in denial-of-service conditions. Note that this vulnerability can be exploited only when an attacker is within the range of broadcast of 802.11 wireless connections. Version 5.148.724.2003 of the MA521nd5.SYS driver is vulnerable to this issue; other versions may also be affected.
To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German.
The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios.
This includes: * Reason for rating * Extended description * Extended solution * Exploit code or links to exploit code * Deep links
Read the full description: http://corporate.secunia.com/products/48/?r=l
Contact Secunia Sales for more information: http://corporate.secunia.com/how_to_buy/15/?r=l
TITLE: NetGear MA521 Wireless Driver Long Rates Memory Corruption
SECUNIA ADVISORY ID: SA23036
VERIFY ADVISORY: http://secunia.com/advisories/23036/
CRITICAL: Moderately critical
IMPACT: System access
WHERE:
From remote
SOFTWARE: NetGear MA521 802.11b Wireless PC Card 5.x http://secunia.com/product/12673/
DESCRIPTION: Laurent Butti has reported a vulnerability in NetGear MA521 Wireless driver, which can be exploited by malicious people to compromise a vulnerable system. This can be exploited to cause a memory corruption via a specially crafted packet when the driver is running in active scanning mode.
The vulnerability is reported in version 5.148.724.2003.
SOLUTION: Turn off the wireless card when not in use.
PROVIDED AND/OR DISCOVERED BY: Laurent Butti
ORIGINAL ADVISORY: http://projects.info-pull.com/mokb/MOKB-18-11-2006.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200611-0485",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ma521 driver",
"scope": "lte",
"trust": 1.0,
"vendor": "netgear",
"version": "5.148.724.2003"
},
{
"model": "ma521 driver",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "5.148.724.2003"
},
{
"model": "ma521 driver",
"scope": "eq",
"trust": 0.7,
"vendor": "netgear",
"version": "5.148.724.2003"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "ma521nd5.sys driver",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "5.148.7242003"
},
{
"model": "ma521 wireless adapter",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-8551"
},
{
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"db": "BID",
"id": "21175"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:netgear:ma521_driver:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.148.724.2003",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6059"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Laurent Butti laurent.butti@orange-ftgroup.comH D Moore hdm@metasploit.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
],
"trust": 0.6
},
"cve": "CVE-2006-6059",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2006-6059",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-22167",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-6059",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#395496",
"trust": 0.8,
"value": "3.99"
},
{
"author": "CNNVD",
"id": "CNNVD-200611-325",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-22167",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2006-6059",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#395496"
},
{
"db": "VULHUB",
"id": "VHN-22167"
},
{
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via (1) beacon or (2) probe 802.11 frame responses with an long supported rates information element. NOTE: this issue was reported as a \"memory corruption\" error, but the associated exploit code suggests that it is a buffer overflow. A buffer overflow vulnerability exists in the Netgear MA521nd5.SYS wireless driver. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or cause a denial-of-service condition. NetGear MA521 is an 802.11b wireless PC network card. \n\n\u00a0If a malformed frame (beacon or probe response) is received in the active scan mode, the MA521nd5.SYS driver of the MA521 will attempt to write to a memory location controlled by the attacker. Failed attempts will likely crash the kernel, resulting in denial-of-service conditions. \nNote that this vulnerability can be exploited only when an attacker is within the range of broadcast of 802.11 wireless connections. \nVersion 5.148.724.2003 of the MA521nd5.SYS driver is vulnerable to this issue; other versions may also be affected. \n\n----------------------------------------------------------------------\n\nTo improve our services to our customers, we have made a number of\nadditions to the Secunia Advisories and have started translating the\nadvisories to German. \n\nThe improvements will help our customers to get a better\nunderstanding of how we reached our conclusions, how it was rated,\nour thoughts on exploitation, attack vectors, and scenarios. \n\nThis includes:\n* Reason for rating\n* Extended description\n* Extended solution\n* Exploit code or links to exploit code\n* Deep links\n\nRead the full description:\nhttp://corporate.secunia.com/products/48/?r=l\n\nContact Secunia Sales for more information:\nhttp://corporate.secunia.com/how_to_buy/15/?r=l\n\n----------------------------------------------------------------------\n\nTITLE:\nNetGear MA521 Wireless Driver Long Rates Memory Corruption\n\nSECUNIA ADVISORY ID:\nSA23036\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/23036/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nNetGear MA521 802.11b Wireless PC Card 5.x\nhttp://secunia.com/product/12673/\n\nDESCRIPTION:\nLaurent Butti has reported a vulnerability in NetGear MA521 Wireless\ndriver, which can be exploited by malicious people to compromise a\nvulnerable system. This can\nbe exploited to cause a memory corruption via a specially crafted\npacket when the driver is running in active scanning mode. \n\nThe vulnerability is reported in version 5.148.724.2003. \n\nSOLUTION:\nTurn off the wireless card when not in use. \n\nPROVIDED AND/OR DISCOVERED BY:\nLaurent Butti\n\nORIGINAL ADVISORY:\nhttp://projects.info-pull.com/mokb/MOKB-18-11-2006.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"db": "CERT/CC",
"id": "VU#395496"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"db": "CNVD",
"id": "CNVD-2006-8551"
},
{
"db": "BID",
"id": "21175"
},
{
"db": "VULHUB",
"id": "VHN-22167"
},
{
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"db": "PACKETSTORM",
"id": "52316"
}
],
"trust": 3.42
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-22167",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=29096",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-22167"
},
{
"db": "VULMON",
"id": "CVE-2006-6059"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#395496",
"trust": 3.7
},
{
"db": "NVD",
"id": "CVE-2006-6059",
"trust": 3.5
},
{
"db": "SECUNIA",
"id": "23036",
"trust": 2.7
},
{
"db": "BID",
"id": "21175",
"trust": 2.1
},
{
"db": "SECTRACK",
"id": "1017254",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2006-4604",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2006-8551",
"trust": 0.6
},
{
"db": "XF",
"id": "30442",
"trust": 0.6
},
{
"db": "XF",
"id": "521",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200611-325",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "29096",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-82632",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-22167",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2006-6059",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "52316",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#395496"
},
{
"db": "CNVD",
"id": "CNVD-2006-8551"
},
{
"db": "VULHUB",
"id": "VHN-22167"
},
{
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"db": "BID",
"id": "21175"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"db": "PACKETSTORM",
"id": "52316"
},
{
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
]
},
"id": "VAR-200611-0485",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-22167"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:40:50.564000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.netgear.com/"
},
{
"title": "wifuzzit",
"trust": 0.1,
"url": "https://github.com/0xd012/wifuzzit "
},
{
"title": "wifuzzit",
"trust": 0.1,
"url": "https://github.com/flowerhack/wifuzzit "
},
{
"title": "wifuzzit",
"trust": 0.1,
"url": "https://github.com/84kaliplexon3/wifuzzit "
},
{
"title": "wifuzzit",
"trust": 0.1,
"url": "https://github.com/plexone2019/wifuzzit "
},
{
"title": "wifuzzit",
"trust": 0.1,
"url": "https://github.com/wi-fi-analyzer/wifuzzit "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-6059"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://www.kb.cert.org/vuls/id/395496"
},
{
"trust": 2.7,
"url": "http://projects.info-pull.com/mokb/mokb-18-11-2006.html"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/21175"
},
{
"trust": 1.8,
"url": "http://securitytracker.com/id?1017254"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/23036"
},
{
"trust": 1.2,
"url": "http://www.vupen.com/english/advisories/2006/4604"
},
{
"trust": 1.2,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30442"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/23036/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-6059"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-6059"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/4604"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/30442"
},
{
"trust": 0.3,
"url": "http://www.netgear.com/products/adapters/bwirelessadapters/ma521.aspx"
},
{
"trust": 0.3,
"url": "http://kernelfun.blogspot.com/2006/11/mokb-18-11-2006-netgear-ma521-wireless.html"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/29096/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/products/48/?r=l"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/15/?r=l"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/12673/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#395496"
},
{
"db": "VULHUB",
"id": "VHN-22167"
},
{
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"db": "BID",
"id": "21175"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"db": "PACKETSTORM",
"id": "52316"
},
{
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#395496"
},
{
"db": "CNVD",
"id": "CNVD-2006-8551"
},
{
"db": "VULHUB",
"id": "VHN-22167"
},
{
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"db": "BID",
"id": "21175"
},
{
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"db": "PACKETSTORM",
"id": "52316"
},
{
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-11-20T00:00:00",
"db": "CERT/CC",
"id": "VU#395496"
},
{
"date": "2006-11-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-8551"
},
{
"date": "2006-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-22167"
},
{
"date": "2006-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"date": "2006-11-18T00:00:00",
"db": "BID",
"id": "21175"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"date": "2006-11-20T16:05:00",
"db": "PACKETSTORM",
"id": "52316"
},
{
"date": "2006-11-22T01:07:00",
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"date": "2006-11-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-11-20T00:00:00",
"db": "CERT/CC",
"id": "VU#395496"
},
{
"date": "2006-11-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-8551"
},
{
"date": "2017-07-20T00:00:00",
"db": "VULHUB",
"id": "VHN-22167"
},
{
"date": "2017-07-20T00:00:00",
"db": "VULMON",
"id": "CVE-2006-6059"
},
{
"date": "2016-07-06T13:33:00",
"db": "BID",
"id": "21175"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2006-002443"
},
{
"date": "2017-07-20T01:34:10.383000",
"db": "NVD",
"id": "CVE-2006-6059"
},
{
"date": "2006-12-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NetGear wireless driver fails to properly process certain 802.11 management frames",
"sources": [
{
"db": "CERT/CC",
"id": "VU#395496"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200611-325"
}
],
"trust": 0.6
}
}
VAR-200112-0139
Vulnerability from variot - Updated: 2023-12-18 12:40D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point uses a default SNMP community string of 'public' which allows remote attackers to gain sensitive information. DLink DWL-1000AP is an 11Mbps wireless LAN access point product for home users. It supports WEP, MAC address control and user authentication.
The product has a security issue that could cause remote attackers to obtain sensitive information.
The device comes with a read-only SNMP communication word named 'public' by default. This communication word cannot be cancelled by setting, so a malicious attacker can use an SNMP client to browse to the sensitive information in the 'public' management system library. This community string is hard-coded into the product and cannot be changed with the configuration interface. This issue has been confirmed with the 3.2.28 #483 (Aug 23 2001) firmware. Other versions of the firmware may also be affected
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200112-0139",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dwl-1000ap",
"scope": "eq",
"trust": 1.6,
"vendor": "d link",
"version": "3.2.28_483"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "dwl-1000ap #483",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "3.2.28"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"db": "BID",
"id": "3736"
},
{
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dwl-1000ap:3.2.28_483:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2001-1221"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jonathan Strine\u203b jstrine@netpanel.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
],
"trust": 0.6
},
"cve": "CVE-2001-1221",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-4026",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2001-1221",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200112-131",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-4026",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-4026"
},
{
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point uses a default SNMP community string of \u0027public\u0027 which allows remote attackers to gain sensitive information. DLink DWL-1000AP is an 11Mbps wireless LAN access point product for home users. It supports WEP, MAC address control and user authentication. \n\n\u00a0The product has a security issue that could cause remote attackers to obtain sensitive information. \n\n\u00a0The device comes with a read-only SNMP communication word named \u0027public\u0027 by default. This communication word cannot be cancelled by setting, so a malicious attacker can use an SNMP client to browse to the sensitive information in the \u0027public\u0027 management system library. This community string is hard-coded into the product and cannot be changed with the configuration interface. \nThis issue has been confirmed with the 3.2.28 #483 (Aug 23\n2001) firmware. Other versions of the firmware may also be affected",
"sources": [
{
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"db": "BID",
"id": "3736"
},
{
"db": "VULHUB",
"id": "VHN-4026"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2001-1221",
"trust": 2.6
},
{
"db": "BID",
"id": "3736",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2001-3259",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20011221 D-LINK DWL-1000AP CAN BE COMPROMISED BECAUSE OF SNMP CONFIGURATION",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-4026",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"db": "VULHUB",
"id": "VHN-4026"
},
{
"db": "BID",
"id": "3736"
},
{
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
]
},
"id": "VAR-200112-0139",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"db": "VULHUB",
"id": "VHN-4026"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3259"
}
]
},
"last_update_date": "2023-12-18T12:40:42.613000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2001-1221"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/3736"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/246849"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/products/wireless/dwl1000ap/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-4026"
},
{
"db": "BID",
"id": "3736"
},
{
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"db": "VULHUB",
"id": "VHN-4026"
},
{
"db": "BID",
"id": "3736"
},
{
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-12-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"date": "2001-12-21T00:00:00",
"db": "VULHUB",
"id": "VHN-4026"
},
{
"date": "2001-12-21T00:00:00",
"db": "BID",
"id": "3736"
},
{
"date": "2001-12-21T05:00:00",
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"date": "2001-12-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-12-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"date": "2008-09-05T00:00:00",
"db": "VULHUB",
"id": "VHN-4026"
},
{
"date": "2009-07-11T09:06:00",
"db": "BID",
"id": "3736"
},
{
"date": "2008-09-05T20:25:59.610000",
"db": "NVD",
"id": "CVE-2001-1221"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DWL-1000AP Wireless LAN Access Point \u0027public\u0027 Password Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3259"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "3736"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-131"
}
],
"trust": 0.9
}
}
VAR-200112-0138
Vulnerability from variot - Updated: 2023-12-18 12:40D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plaintext in the default Management Information Base (MIB), which allows remote attackers to gain administrative privileges. DLink DWL-1000AP is an 11Mbps wireless LAN access point product for home users. It supports WEP, MAC address control and user authentication.
The product has a security issue that could cause a remote attacker to hijack the access point.
This is because the administrator password is stored in plain text in the default 'public' management system library (OID 1.3.6.1.4.1.937.2.1.2.2.0). An attacker who has access to this management system library may pass the SNMP client Obtain the password, then access the wireless network, modify the configuration, or launch a denial of service attack. Any attacker within range, using a SNMP client, can reveal the administrative password by browsing the "public" MIB. This issue has been confirmed with the 3.2.28 #483 (Aug 23 2001) firmware. Other versions of the firmware may also be affected
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200112-0138",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dwl-1000ap",
"scope": "eq",
"trust": 1.6,
"vendor": "d link",
"version": "3.2.28_483"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "dwl-1000ap #483",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "3.2.28"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3262"
},
{
"db": "BID",
"id": "3735"
},
{
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dwl-1000ap:3.2.28_483:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2001-1220"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jonathan Strine\u203b jstrine@netpanel.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
],
"trust": 0.6
},
"cve": "CVE-2001-1220",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-4025",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2001-1220",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200112-132",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-4025",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-4025"
},
{
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plaintext in the default Management Information Base (MIB), which allows remote attackers to gain administrative privileges. DLink DWL-1000AP is an 11Mbps wireless LAN access point product for home users. It supports WEP, MAC address control and user authentication. \n\n\u00a0The product has a security issue that could cause a remote attacker to hijack the access point. \n\n\u00a0This is because the administrator password is stored in plain text in the default \u0027public\u0027 management system library (OID 1.3.6.1.4.1.937.2.1.2.2.0). An attacker who has access to this management system library may pass the SNMP client Obtain the password, then access the wireless network, modify the configuration, or launch a denial of service attack. Any attacker within range, using a SNMP client, can reveal the administrative password by browsing the \"public\" MIB. \nThis issue has been confirmed with the 3.2.28 #483 (Aug 23\n2001) firmware. Other versions of the firmware may also be affected",
"sources": [
{
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"db": "CNVD",
"id": "CNVD-2001-3262"
},
{
"db": "BID",
"id": "3735"
},
{
"db": "VULHUB",
"id": "VHN-4025"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2001-1220",
"trust": 2.6
},
{
"db": "BID",
"id": "3735",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200112-132",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2001-3262",
"trust": 0.6
},
{
"db": "XF",
"id": "7733",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20011221 D-LINK DWL-1000AP CAN BE COMPROMISED BECAUSE OF SNMP CONFIGURATION",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-4025",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3262"
},
{
"db": "VULHUB",
"id": "VHN-4025"
},
{
"db": "BID",
"id": "3735"
},
{
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
]
},
"id": "VAR-200112-0138",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3262"
},
{
"db": "VULHUB",
"id": "VHN-4025"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3262"
}
]
},
"last_update_date": "2023-12-18T12:40:42.586000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2001-1220"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/3735"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/246849"
},
{
"trust": 1.7,
"url": "http://www.iss.net/security_center/static/7733.php"
},
{
"trust": 0.3,
"url": "http://www.dlink.com/products/wireless/dwl1000ap/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-4025"
},
{
"db": "BID",
"id": "3735"
},
{
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2001-3262"
},
{
"db": "VULHUB",
"id": "VHN-4025"
},
{
"db": "BID",
"id": "3735"
},
{
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-12-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-3262"
},
{
"date": "2001-12-21T00:00:00",
"db": "VULHUB",
"id": "VHN-4025"
},
{
"date": "2001-12-21T00:00:00",
"db": "BID",
"id": "3735"
},
{
"date": "2001-12-21T05:00:00",
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"date": "2001-12-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-12-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-3262"
},
{
"date": "2008-09-05T00:00:00",
"db": "VULHUB",
"id": "VHN-4025"
},
{
"date": "2009-07-11T09:06:00",
"db": "BID",
"id": "3735"
},
{
"date": "2008-09-05T20:25:59.470000",
"db": "NVD",
"id": "CVE-2001-1220"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DWL-1000AP WLAN Access Point Plain Text Password Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-3262"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "3735"
},
{
"db": "CNNVD",
"id": "CNNVD-200112-132"
}
],
"trust": 0.9
}
}
VAR-200512-0210
Vulnerability from variot - Updated: 2023-12-18 12:40Motorola SB5100E Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LAND). Motorola cable modem is a network device that connects PC, TV, telephone, fax and other devices to the Internet through a coaxial cable.
Motorola cable modems have a denial of service vulnerability when processing TCP Land messages, which may allow an attacker to block communication to any target network service. The device must be physically restarted to resume normal operation. This issue allows attackers to block network traffic to arbitrarily targeted network services
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200512-0210",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cable modem",
"scope": "eq",
"trust": 1.6,
"vendor": "motorola",
"version": "sb5100e"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "cable modem sb5100e",
"scope": null,
"trust": 0.3,
"vendor": "motorola",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2005-4724"
},
{
"db": "BID",
"id": "15795"
},
{
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:motorola:motorola_cable_modem:sb5100e:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-4215"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alexey Sintsov don_huan@xakep.ru",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
],
"trust": 0.6
},
"cve": "CVE-2005-4215",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-15423",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2005-4215",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200512-288",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-15423",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-15423"
},
{
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Motorola SB5100E Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LAND). Motorola cable modem is a network device that connects PC, TV, telephone, fax and other devices to the Internet through a coaxial cable. \n\n\u00a0Motorola cable modems have a denial of service vulnerability when processing TCP Land messages, which may allow an attacker to block communication to any target network service. The device must be physically restarted to resume normal operation. \nThis issue allows attackers to block network traffic to arbitrarily targeted network services",
"sources": [
{
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"db": "CNVD",
"id": "CNVD-2005-4724"
},
{
"db": "BID",
"id": "15795"
},
{
"db": "VULHUB",
"id": "VHN-15423"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2005-4215",
"trust": 2.3
},
{
"db": "BID",
"id": "15795",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "17996",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2005-2864",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200512-288",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2005-4724",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20051209 MOTOROLA SB5100E CABLE MODEM DOS",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-15423",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2005-4724"
},
{
"db": "VULHUB",
"id": "VHN-15423"
},
{
"db": "BID",
"id": "15795"
},
{
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
]
},
"id": "VAR-200512-0210",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-15423"
}
],
"trust": 0.9333333
},
"last_update_date": "2023-12-18T12:40:15.952000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-4215"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/15795"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/17996"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2005/2864"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=113416527000313\u0026w=2"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2005/2864"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=113416527000313\u0026w=2"
},
{
"trust": 0.3,
"url": "http://broadband.motorola.com/catalog/productdetail.asp?image=large\u0026productid=396"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=113416527000313\u0026amp;w=2"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-15423"
},
{
"db": "BID",
"id": "15795"
},
{
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2005-4724"
},
{
"db": "VULHUB",
"id": "VHN-15423"
},
{
"db": "BID",
"id": "15795"
},
{
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-12-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2005-4724"
},
{
"date": "2005-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-15423"
},
{
"date": "2005-12-09T00:00:00",
"db": "BID",
"id": "15795"
},
{
"date": "2005-12-14T11:03:00",
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"date": "2005-12-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-12-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2005-4724"
},
{
"date": "2016-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-15423"
},
{
"date": "2005-12-09T00:00:00",
"db": "BID",
"id": "15795"
},
{
"date": "2016-10-18T03:38:03.190000",
"db": "NVD",
"id": "CVE-2005-4215"
},
{
"date": "2005-12-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Motorola SB5100E Cable Modem LanD Packet Denial Of Service Vulnerability",
"sources": [
{
"db": "BID",
"id": "15795"
},
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200512-288"
}
],
"trust": 0.6
}
}
VAR-200805-0133
Vulnerability from variot - Updated: 2023-12-18 12:39The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413, which causes a memory allocation failure. Wonderware SuiteLink Crafted by TCP Denial of service when processing packets (DoS) There are vulnerabilities that may be affected. Wonderware SuiteLink Is the protocol used in the control system. Implemented this protocol Wonderware SuiteLink Service(slssvc.exe) Is Windows As a service on 5413/tcp Use to communicate. Wonderware SuiteLink Service(slssvc.exe) In TCP There is a problem with the processing of the packet, and receiving a specially crafted packet can cause a service outage.Denial of service by remote third party (DoS) There is a possibility of being attacked. WonderWare is a supplier of industrial automation and information software solutions. WonderWare has a vulnerability in processing malformed request data, which could be exploited by remote attackers to render services unavailable. WonderWare's SuiteLink service listens for connections on port 5413 / TCP. Non-authenticated client programs connected to the service can send malformed messages, and by calling the new () operator, the memory allocation operation fails and returns a null pointer. Due to the lack of error checking on the results of memory allocation operations, the program may later use null pointers as targets for memory copy operations, which may trigger memory access exceptions and terminate services. An attacker can trigger a memory allocation operation failure by specifying an oversized field in the Registration message. The following binary program segment describes the cause of the vulnerability: .text: 00405C1B mov esi, [ebp + dwLen]; Our value from packet
...
.text: 00405C20 push edi
.text: 00405C21 test esi, esi; Check value! = 0
...
.text: 00405C31 push esi; Alloc with our length
.text: 00405C32 mov [ebp + var_4], 0
.text: 00405C39 call operator new (uint); Big values return NULL
.text: 00405C3E mov ecx, esi; Memcpy with our length
.text: 00405C40 mov esi, [ebp + pDestionationAddr]
.text: 00405C43 mov [ebx + 4], eax; new result is used as dest
.text: 00405C46 mov edi, eax; address without checks.
.text: 00405C48 mov eax, ecx
.text: 00405C4A add esp, 4
.text: 00405C4D shr ecx, 2
.text: 00405C50 rep movsd; AV due to invalid
.text: 00405C52 mov ecx, eax; destination pointer.
.text: 00405C54 and ecx, 3
------------ /. Wonderware SuiteLink is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to execute arbitrary code, but this has not been confirmed. Versions prior to Wonderware SuiteLink 2.0 Patch 01 are vulnerable. UPDATE: References to Wonderware InTouch 8.0 have been removed; that software is not affected by this vulnerability. ----------------------------------------------------------------------
Secunia Network Software Inspector 2.0 (NSI) - Public Beta
The Public Beta has ended. Thanks to all that participated.
PROVIDED AND/OR DISCOVERED BY: Sebastian Muniz, Core Security Technologies
ORIGINAL ADVISORY: Wonderware (requires login): http://www.wonderware.com/support/mmi/comprehensive/kbcd/html/t002260.htm
CORE-2008-0129: http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=2187
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Core Security Technologies - CoreLabs Advisory
http://www.coresecurity.com/corelabs/
Wonderware SuiteLink Denial of Service vulnerability
Advisory Information
Title: Wonderware SuiteLink Denial of Service vulnerability Advisory ID: CORE-2008-0129 Advisory URL: http://www.coresecurity.com/?action=item&id=2187 Date published: 2008-05-05 Date of last update: 2008-05-05 Vendors contacted: Wonderware Release mode: Coordinated release
Vulnerability Information
Class: Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
Bugtraq ID: 28974
CVE Name: CVE-2008-2005
Vulnerability Description
WonderWare is supplier of industrial automation and information software solutions. According to the company's website [1]: "one third of the world's plants run Wonderware software solutions. Having sold more than 500,000 software licenses in over 100,000 plants worldwide, Wonderware has customers in virtually every global industry - including Oil & Gas, Food & Beverage, Utilities, Pharmaceuticals, Electronics, Metals, Automotive and more".
WonderWare offers software solutions in the areas of Production and Performance Management, and Geographical SCADA and Supervisory HMI (Human-Machine Interface). Several of these solutions running on Microsoft Windows Operating Systems use a common software component, the SuiteLink Service, to implement communications between components using a proprietary protocol over TCP/IP networks. Exploitation of the vulnerability for remote code execution has not been proven, but it has not been eliminated as a potential scenario.
Vulnerable Packages
.
Non-vulnerable Packages
. Contact WonderWare for details.
Vendor Information, Solutions and Workarounds
The vendor has made a technical document available to registered customers detailing how to address this issue [2]. Additionally, an extensive guide detailing how to deploy and secure Industrial Control Systems is available at the vendor's support site [3].
Vendor Statement:
Wonderware, a business unit of Invensys, is committed to collaborate with our customers and industry standards committees to provide secure applications, security best practices, deployment guidelines, tools and prescriptive guidance for maintaining a secure environment. A potential denial of service issue on an insecure network which could have been instigated by a hostile internal user has been addressed in SuiteLink 2.0 Patch 01. More details can be found in Wonderware's Tech Alert 106 posted on our website along with the Patch. (Please note that access to the Tech Alert and the Patch will require that you register on our web site.) Wonderware users interested in upgrading should contact Wonderware or their local distributor.
Credits
This vulnerability was discovered and researched by Sebastian Muniz from the Exploit Writers Team (EWT) at Core Security Technologies.
Technical Description / Proof of Concept Code
WonderWare SuiteLink is a service that runs on Microsoft Windows Operating Systems listening for connections on port 5413/tcp. .text:00405C54 and ecx, 3
- -----------/
Report Timeline
. 2008-01-30: Initial contact email sent by to Wonderware setting the estimated publication date of the advisory to February 25th. 2008-01-30: Contact email re-sent to Wonderware asking for a software security contact for Wonderware InTouch. 2008-02-06: New email sent to Wonderware asking for a response and for a software security contact for Wonderware InTouch. 2008-02-28: Core makes direct phone calls to Wonderware headquarters informing of the previous emails and requesting acknowledgement of the notification of a security vulnerability. 2008-02-28: As requested during the phone call, Core re-sends the original notification mail, stating that an advisory draft describing the vulnerability is available since January 30th. The publication of the advisory is re-scheduled to March 24th. 2008-02-28: Vendor acknowledges the email notification. 2008-02-28: Core sends the advisory draft to Wonderware support team. 2008-02-29: Vendor acknowledges reception of the report and states that it understands the seriousness of the problem and that its development team will look into it. 2008-02-29: Vendor asks for a copy of the proof of concept code used to demonstrate the vulnerability. 2008-03-03: Core sends proof-of-concept code written in Python. 2008-03-05: Vendor asks for compiler tools required to use the PoC code. 2008-03-05: Core sends a link to http://www.python.org where a Python interpreter can be downloaded. 2008-03-10: Vendor requests more information about the network and the firewall settings used during the tests and inquires about conformance (or lack thereof) of the tested network with the vendor's security policies and recommendations. 2008-03-10: Vendor asks for details about how the advisory will be published. 2008-03-12: Core responds that the workstation running the vulnerable service had no firewall activated in the tests, but since the Wonderware SuiteLink Service allows incoming connections it is assumed that the corresponding port should be allowed to receive inbound session establishment packets. Core offers the vendor the opportunity to include additional information in the "vendor information" section of the advisory. Core explains that the advisory will be published on Core's website and sent to security mailing lists. Core also reminds the vendor that the publication date of the advisory has been moved from February 25th to March 24th, and explains that it is willing to discuss a new publication date on the basis of having concrete plans, with a specific date for the fix release. 2008-03-21: Vendor indicates that it will be unable to commit to releasing fixes by March 24th and requests publication of the advisory to be delayed to create a fix for vulnerable customers. The development team is investigating how long it will take to make such a fix available. The vendor indicates that the previous questions about firewall setup referred to the vendor's recommended practices to secure networks on which their systems run using firewalls and IPsec. 2008-03-21: Vendor indicates that it is issuing a Tech Alert to its customers to address the issue. Details about the vulnerability have been minimized in the Tech Alert. The vendor expresses concern about the level of detail included in Core's advisory and requests that those details be removed from the advisory because they give more detail than what is needed to make people aware of the issue, and may lend itself to use by people who might want to exploit it. Early estimates put the delivery time for a fix at approximately three months, and the estimate is not final. Vendor asks Core to delay any publication until it is able to have a software fix ready. 2008-03-21: Core asks if the three-month estimate should be assumed to have begun since the vendor's initial acknowledgement of Core's notification -- which puts the estimated date for the release of a fix at the end of May -- or since the date of the last email received (fix released at the end of June). Core indicates that as of today it still has no confirmation from the vendor that the vulnerability was replicated and identified, and that the fix is already under development or testing, and that is the information needed to re-schedule the publication date. Core is expecting to receive that information from the vendor, but in the meantime publication of the advisory is re-scheduled to March 31st 2008. With regards to the questions and requests about the contents of the security advisory, Core indicates that Core's technical publications are aimed at providing legitimate security practitioners worldwide with the technical details necessary to understand the nature of the security issues reported; so they are able to devise, by their own judgment, the risk mitigation approach that fits them the best. For that purpose, Core believes that it is fundamental that they have precise and accurate technical details about security issues -- as Wonderware itself has demonstrated with the request for further technical details and proof-of-concept code -- and that the whole reporting and disclosure process is transparent for scrutiny of all interested parties. 2008-03-21: Vendor acknowledges Core's email and provides a copy of the issued Technical Alert 106 and indicates that will provide more information by March 25th 2008. 2008-03-26: Vendor confirms to have replicated the issue reported and indicated that the Tech Alert 106 sent to customers confirms and recognizes the issue. The Tech Alert also points out what measures can be taken to mitigate risk. A project has been charter and is in progress to fix this issue and properly QA the fix. With regard to the contents of Core's report, it says that stating that a Denial of Service of SuiteLink communication can be created from a remote node sends a corrupted data packet seems to be sufficient to make people aware. The vendor says that is having trouble understanding what the value is in providing specific detail as to what technical issue is happening and asks for clarification to understand how this information would benefit organizations. The vendor acknowledges that the proof of concept code did help to replicate the issue and that without it, it would have needed more time to identify it from the report alone. The concern is that the details provided in the report may give a hacker a specific direction to look for the vulnerability. Finally, the vendor indicates that will have a better estimation for the rlease date of a fix by Friday March 28th, 2008. 2008-03-27: Core acknowledges the vendor's email and indicates that is looking forward to having the new estimate by Friday. 2008-03-28: Vendor informs that it has brought the estimated release date in to May 2nd. If things go well during QA, they may be able to bring that date in sooner and vendor requests that Core postpone publication until that time. 2008-03-28: Core re-schedules publication of the advisory to May 2nd 2008 and says that it considers this date final unless the vendor indicates any deviation from the current estimate with at least a week in advance of the publication date, in which case Core would re-evaluate postponing publication up to 5 working days. With regard to the previous inquiry about the advisory's content, Core states that the purpose of publishing security advisories and the rationale used to define their content is simple and hopefully, once explained, both reasonable and understandable. Core publishes advisories not only to make users aware of the existence of a given vulnerability but also to facilitate its mitigation by either official or any other means that the security community and/or the vulnerable user population may devise. In order to do so, Core has learned over the course of 13 years working in this particular field that it is fundamental to provide precise and accurate technical information about problems. It is that information that can help other security practitioners to determine how to prevent exploitation, detect attacks or to verify that a fix or workaround is actually functioning properly. Thus, Core believes that it is necessary not only to indicate the mere existence of the bug, but also to explain how to uniquely identify it in the vulnerable software (to avoid confusion with all other known bugs or to differentiate it from others that may be discovered in the future). It is also important to determine how the vulnerability could be used by potential attackers so that proper detection mechanisms can be built, for example firewall rules, or IDS and antivirus signatures. While Core recognizes that this may provide some additional data to would-be attackers, clearly it also provides preciously needed information to the defenders thus, leveling a field on which Core believes the attackers are initially at advantage. 2008-04-01: Vendor acknowledges previous email and indicates that it will provide a new update as soon as is available. 2008-04-28: Vendor informs Core that a fix for the vulnerability in SuiteLink has been released. 2008-04-28: Core acknowledges previous emails and requests an official vendor statement for the security advisory and more details about the vulnerable packages and versions. Multiple products use SuiteLink. 2008-04-30: The advisory is ready for release, but the publication date is re-scheduled to May 5th because May 1st is a public holiday in many countries (International Workers' Day) and Core does not usually publish advisories on Fridays (to avoid IT work on weekends). 2008-05-05: CORE-2008-0129 advisory is published.
References
[1] WonderWare website http://us.wonderware.com/ [2] Tech Alert 106 http://www.wonderware.com/support/mmi/comprehensive/kbcd/html/t002260.htm [3] WonderWare Security Manual - Securing Industrial Control Systems
http://www.wonderware.com/support/mmi/esupport/securitycentral/documents/BestPractices/WWSecGd041707_External.pdf
About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs/.
About Core Security Technologies
Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the most comprehensive product for performing enterprise security assurance testing. CORE IMPACT evaluates network, endpoint and end-user vulnerabilities and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core Security Technologies augments its leading technology solution with world-class security consulting services, including penetration testing and software security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com.
Disclaimer
The contents of this advisory are copyright (c) 2008 Core Security Technologies and (c) 2008 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given.
GPG/PGP Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFIH2eAyNibggitWa0RAtlcAKCgV83vS0v4aLVTRtFmkBsEg0UPXgCdHL4p si+I8mGJwJuglh+QESsZ9ZE= =705O -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200805-0133",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "suitelink",
"scope": "eq",
"trust": 1.9,
"vendor": "wonderware",
"version": "2.0"
},
{
"model": "intouch",
"scope": "eq",
"trust": 1.6,
"vendor": "wonderware",
"version": "8.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "invensys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "wonderware",
"version": null
},
{
"model": "suitelink",
"scope": "lt",
"trust": 0.8,
"vendor": "wonderware",
"version": "version 2.0 patch 01 earlier"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "intouch",
"version": "8.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "suitelink",
"version": "2.0"
},
{
"model": "suitelink patch",
"scope": "ne",
"trust": 0.3,
"vendor": "wonderware",
"version": "2.001"
}
],
"sources": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CERT/CC",
"id": "VU#596268"
},
{
"db": "CNVD",
"id": "CNVD-2008-2191"
},
{
"db": "BID",
"id": "28974"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:wonderware:intouch:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:wonderware:suitelink:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-2005"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sebastian Muniz",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
],
"trust": 0.6
},
"cve": "CVE-2008-2005",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2008-2005",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-2005",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#596268",
"trust": 0.8,
"value": "3.07"
},
{
"author": "CNNVD",
"id": "CNNVD-200805-037",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CERT/CC",
"id": "VU#596268"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary code via a large length value in a Registration packet to TCP port 5413, which causes a memory allocation failure. Wonderware SuiteLink Crafted by TCP Denial of service when processing packets (DoS) There are vulnerabilities that may be affected. Wonderware SuiteLink Is the protocol used in the control system. Implemented this protocol Wonderware SuiteLink Service(slssvc.exe) Is Windows As a service on 5413/tcp Use to communicate. Wonderware SuiteLink Service(slssvc.exe) In TCP There is a problem with the processing of the packet, and receiving a specially crafted packet can cause a service outage.Denial of service by remote third party (DoS) There is a possibility of being attacked. WonderWare is a supplier of industrial automation and information software solutions. WonderWare has a vulnerability in processing malformed request data, which could be exploited by remote attackers to render services unavailable. WonderWare\u0027s SuiteLink service listens for connections on port 5413 / TCP. Non-authenticated client programs connected to the service can send malformed messages, and by calling the new () operator, the memory allocation operation fails and returns a null pointer. Due to the lack of error checking on the results of memory allocation operations, the program may later use null pointers as targets for memory copy operations, which may trigger memory access exceptions and terminate services. An attacker can trigger a memory allocation operation failure by specifying an oversized field in the Registration message. The following binary program segment describes the cause of the vulnerability: .text: 00405C1B mov esi, [ebp + dwLen]; Our value from packet\n\n\u00a0... \n\n\u00a0.text: 00405C20 push edi\n\n\u00a0.text: 00405C21 test esi, esi; Check value! = 0\n\n\u00a0... \n\n\u00a0.text: 00405C31 push esi; Alloc with our length\n\n\u00a0.text: 00405C32 mov [ebp + var_4], 0\n\n\u00a0.text: 00405C39 call operator new (uint); Big values return NULL\n\n\u00a0.text: 00405C3E mov ecx, esi; Memcpy with our length\n\n\u00a0.text: 00405C40 mov esi, [ebp + pDestionationAddr]\n\n\u00a0.text: 00405C43 mov [ebx + 4], eax; new result is used as dest\n\n\u00a0.text: 00405C46 mov edi, eax; address without checks. \n\n\u00a0.text: 00405C48 mov eax, ecx\n\n\u00a0.text: 00405C4A add esp, 4\n\n\u00a0.text: 00405C4D shr ecx, 2\n\n\u00a0.text: 00405C50 rep movsd; AV due to invalid\n\n\u00a0.text: 00405C52 mov ecx, eax; destination pointer. \n\n\u00a0.text: 00405C54 and ecx, 3\n\n\u00a0------------ /. Wonderware SuiteLink is prone to a remote denial-of-service vulnerability. \nAn attacker can exploit this issue to crash the affected application, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to execute arbitrary code, but this has not been confirmed. \nVersions prior to Wonderware SuiteLink 2.0 Patch 01 are vulnerable. \nUPDATE: References to Wonderware InTouch 8.0 have been removed; that software is not affected by this vulnerability. ----------------------------------------------------------------------\n\nSecunia Network Software Inspector 2.0 (NSI) - Public Beta\n\nThe Public Beta has ended. Thanks to all that participated. \n\nPROVIDED AND/OR DISCOVERED BY:\nSebastian Muniz, Core Security Technologies\n\nORIGINAL ADVISORY:\nWonderware (requires login):\nhttp://www.wonderware.com/support/mmi/comprehensive/kbcd/html/t002260.htm\n\nCORE-2008-0129:\nhttp://www.coresecurity.com/index.php5?module=ContentMod\u0026action=item\u0026id=2187\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n Core Security Technologies - CoreLabs Advisory\n http://www.coresecurity.com/corelabs/\n\n Wonderware SuiteLink Denial of Service vulnerability\n\n\n*Advisory Information*\n\nTitle: Wonderware SuiteLink Denial of Service vulnerability\nAdvisory ID: CORE-2008-0129\nAdvisory URL: http://www.coresecurity.com/?action=item\u0026id=2187\nDate published: 2008-05-05\nDate of last update: 2008-05-05\nVendors contacted: Wonderware\nRelease mode: Coordinated release\n\n\n*Vulnerability Information*\n\nClass: Denial of service\nRemotely Exploitable: Yes\nLocally Exploitable: No\nBugtraq ID: 28974\t\nCVE Name: CVE-2008-2005\t\n\n\n*Vulnerability Description*\n\nWonderWare is supplier of industrial automation and information software\nsolutions. According to the company\u0027s website [1]: \"one third of the\nworld\u0027s plants run Wonderware software solutions. Having sold more than\n500,000 software licenses in over 100,000 plants worldwide, Wonderware\nhas customers in virtually every global industry - including Oil \u0026 Gas,\nFood \u0026 Beverage, Utilities, Pharmaceuticals, Electronics, Metals,\nAutomotive and more\". \n\nWonderWare offers software solutions in the areas of Production and\nPerformance Management, and Geographical SCADA and Supervisory HMI\n(Human-Machine Interface). Several of these solutions running on\nMicrosoft Windows Operating Systems use a common software component, the\nSuiteLink Service, to implement communications between components using\na proprietary protocol over TCP/IP networks. Exploitation of the\nvulnerability for remote code execution has not been proven, but it has\nnot been eliminated as a potential scenario. \n\n\n*Vulnerable Packages*\n\n. \n\n\n*Non-vulnerable Packages*\n\n. Contact WonderWare for details. \n\n\n*Vendor Information, Solutions and Workarounds*\n\nThe vendor has made a technical document available to registered\ncustomers detailing how to address this issue [2]. Additionally, an\nextensive guide detailing how to deploy and secure Industrial Control\nSystems is available at the vendor\u0027s support site [3]. \n\nVendor Statement:\n\n Wonderware, a business unit of Invensys, is committed to collaborate\nwith our customers and industry standards committees to provide secure\napplications, security best practices, deployment guidelines, tools and\nprescriptive guidance for maintaining a secure environment. A potential\ndenial of service issue on an insecure network which could have been\ninstigated by a hostile internal user has been addressed in SuiteLink\n2.0 Patch 01. More details can be found in Wonderware\u0027s Tech Alert 106\nposted on our website along with the Patch. (Please note that access to\nthe Tech Alert and the Patch will require that you register on our web\nsite.) Wonderware users interested in upgrading should contact\nWonderware or their local distributor. \n\n\n*Credits*\n\nThis vulnerability was discovered and researched by Sebastian Muniz from\nthe Exploit Writers Team (EWT) at Core Security Technologies. \n\n\n*Technical Description / Proof of Concept Code*\n\nWonderWare SuiteLink is a service that runs on Microsoft Windows\nOperating Systems listening for connections on port 5413/tcp. \n.text:00405C54 and ecx, 3\n\n- -----------/\n\n\n*Report Timeline*\n\n. 2008-01-30: Initial contact email sent by to Wonderware setting the\nestimated publication date of the advisory to February 25th. 2008-01-30: Contact email re-sent to Wonderware asking for a software\nsecurity contact for Wonderware InTouch. 2008-02-06: New email sent to Wonderware asking for a response and for\na software security contact for Wonderware InTouch. 2008-02-28: Core makes direct phone calls to Wonderware headquarters\ninforming of the previous emails and requesting acknowledgement of the\nnotification of a security vulnerability. 2008-02-28: As requested during the phone call, Core re-sends the\noriginal notification mail, stating that an advisory draft describing\nthe vulnerability is available since January 30th. The publication of\nthe advisory is re-scheduled to March 24th. 2008-02-28: Vendor acknowledges the email notification. 2008-02-28: Core sends the advisory draft to Wonderware support team. 2008-02-29: Vendor acknowledges reception of the report and states\nthat it understands the seriousness of the problem and that its\ndevelopment team will look into it. 2008-02-29: Vendor asks for a copy of the proof of concept code used\nto demonstrate the vulnerability. 2008-03-03: Core sends proof-of-concept code written in Python. 2008-03-05: Vendor asks for compiler tools required to use the PoC code. 2008-03-05: Core sends a link to http://www.python.org where a Python\ninterpreter can be downloaded. 2008-03-10: Vendor requests more information about the network and the\nfirewall settings used during the tests and inquires about conformance\n(or lack thereof) of the tested network with the vendor\u0027s security\npolicies and recommendations. 2008-03-10: Vendor asks for details about how the advisory will be\npublished. 2008-03-12: Core responds that the workstation running the vulnerable\nservice had no firewall activated in the tests, but since the Wonderware\nSuiteLink Service allows incoming connections it is assumed that the\ncorresponding port should be allowed to receive inbound session\nestablishment packets. Core offers the vendor the opportunity to include\nadditional information in the \"vendor information\" section of the\nadvisory. Core explains that the advisory will be published on Core\u0027s\nwebsite and sent to security mailing lists. Core also reminds the vendor\nthat the publication date of the advisory has been moved from February\n25th to March 24th, and explains that it is willing to discuss a new\npublication date on the basis of having concrete plans, with a specific\ndate for the fix release. 2008-03-21: Vendor indicates that it will be unable to commit to\nreleasing fixes by March 24th and requests publication of the advisory\nto be delayed to create a fix for vulnerable customers. The development\nteam is investigating how long it will take to make such a fix\navailable. The vendor indicates that the previous questions about\nfirewall setup referred to the vendor\u0027s recommended practices to secure\nnetworks on which their systems run using firewalls and IPsec. 2008-03-21: Vendor indicates that it is issuing a Tech Alert to its\ncustomers to address the issue. Details about the vulnerability have\nbeen minimized in the Tech Alert. The vendor expresses concern about the\nlevel of detail included in Core\u0027s advisory and requests that those\ndetails be removed from the advisory because they give more detail than\nwhat is needed to make people aware of the issue, and may lend itself to\nuse by people who might want to exploit it. Early estimates put the\ndelivery time for a fix at approximately three months, and the estimate\nis not final. Vendor asks Core to delay any publication until it is able\nto have a software fix ready. 2008-03-21: Core asks if the three-month estimate should be assumed to\nhave begun since the vendor\u0027s initial acknowledgement of Core\u0027s\nnotification -- which puts the estimated date for the release of a fix\nat the end of May -- or since the date of the last email received (fix\nreleased at the end of June). Core indicates that as of today it still\nhas no confirmation from the vendor that the vulnerability was\nreplicated and identified, and that the fix is already under development\nor testing, and that is the information needed to re-schedule the\npublication date. Core is expecting to receive that information from the\nvendor, but in the meantime publication of the advisory is re-scheduled\nto March 31st 2008. With regards to the questions and requests about the\ncontents of the security advisory, Core indicates that Core\u0027s technical\npublications are aimed at providing legitimate security practitioners\nworldwide with the technical details necessary to understand the nature\nof the security issues reported; so they are able to devise, by their\nown judgment, the risk mitigation approach that fits them the best. For\nthat purpose, Core believes that it is fundamental that they have\nprecise and accurate technical details about security issues -- as\nWonderware itself has demonstrated with the request for further\ntechnical details and proof-of-concept code -- and that the whole\nreporting and disclosure process is transparent for scrutiny of all\ninterested parties. 2008-03-21: Vendor acknowledges Core\u0027s email and provides a copy of\nthe issued Technical Alert 106 and indicates that will provide more\ninformation by March 25th 2008. 2008-03-26: Vendor confirms to have replicated the issue reported and\nindicated that the Tech Alert 106 sent to customers confirms and\nrecognizes the issue. The Tech Alert also points out what measures can\nbe taken to mitigate risk. A project has been charter and is in progress\nto fix this issue and properly QA the fix. With regard to the contents\nof Core\u0027s report, it says that stating that a Denial of Service of\nSuiteLink communication can be created from a remote node sends a\ncorrupted data packet seems to be sufficient to make people aware. The\nvendor says that is having trouble understanding what the value is in\nproviding specific detail as to what technical issue is happening and\nasks for clarification to understand how this information would benefit\norganizations. The vendor acknowledges that the proof of concept code\ndid help to replicate the issue and that without it, it would have\nneeded more time to identify it from the report alone. The concern is\nthat the details provided in the report may give a hacker a specific\ndirection to look for the vulnerability. Finally, the vendor indicates\nthat will have a better estimation for the rlease date of a fix by\nFriday March 28th, 2008. 2008-03-27: Core acknowledges the vendor\u0027s email and indicates that is\nlooking forward to having the new estimate by Friday. 2008-03-28: Vendor informs that it has brought the estimated release\ndate in to May 2nd. If things go well during QA, they may be able to\nbring that date in sooner and vendor requests that Core postpone\npublication until that time. 2008-03-28: Core re-schedules publication of the advisory to May 2nd\n2008 and says that it considers this date final unless the vendor\nindicates any deviation from the current estimate with at least a week\nin advance of the publication date, in which case Core would re-evaluate\npostponing publication up to 5 working days. With regard to the previous\ninquiry about the advisory\u0027s content, Core states that the purpose of\npublishing security advisories and the rationale used to define their\ncontent is simple and hopefully, once explained, both reasonable and\nunderstandable. Core publishes advisories not only to make users aware\nof the existence of a given vulnerability but also to facilitate its\nmitigation by either official or any other means that the security\ncommunity and/or the vulnerable user population may devise. In order to\ndo so, Core has learned over the course of 13 years working in this\nparticular field that it is fundamental to provide precise and accurate\ntechnical information about problems. It is that information that can\nhelp other security practitioners to determine how to prevent\nexploitation, detect attacks or to verify that a fix or workaround is\nactually functioning properly. Thus, Core believes that it is necessary\nnot only to indicate the mere existence of the bug, but also to explain\nhow to uniquely identify it in the vulnerable software (to avoid\nconfusion with all other known bugs or to differentiate it from others\nthat may be discovered in the future). It is also important to determine\nhow the vulnerability could be used by potential attackers so that\nproper detection mechanisms can be built, for example firewall rules, or\nIDS and antivirus signatures. While Core recognizes that this may\nprovide some additional data to would-be attackers, clearly it also\nprovides preciously needed information to the defenders thus, leveling a\nfield on which Core believes the attackers are initially at advantage. 2008-04-01: Vendor acknowledges previous email and indicates that it\nwill provide a new update as soon as is available. 2008-04-28: Vendor informs Core that a fix for the vulnerability in\nSuiteLink has been released. 2008-04-28: Core acknowledges previous emails and requests an official\nvendor statement for the security advisory and more details about the\nvulnerable packages and versions. Multiple\nproducts use SuiteLink. 2008-04-30: The advisory is ready for release, but the publication\ndate is re-scheduled to May 5th because May 1st is a public holiday in\nmany countries (International Workers\u0027 Day) and Core does not usually\npublish advisories on Fridays (to avoid IT work on weekends). 2008-05-05: CORE-2008-0129 advisory is published. \n\n\n*References*\n\n[1] WonderWare website http://us.wonderware.com/\n[2] Tech Alert 106\nhttp://www.wonderware.com/support/mmi/comprehensive/kbcd/html/t002260.htm\n[3] WonderWare Security Manual - Securing Industrial Control Systems\n\nhttp://www.wonderware.com/support/mmi/esupport/securitycentral/documents/BestPractices/WWSecGd041707_External.pdf\n\n\n*About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://www.coresecurity.com/corelabs/. \n\n\n*About Core Security Technologies*\n\nCore Security Technologies develops strategic solutions that help\nsecurity-conscious organizations worldwide develop and maintain a\nproactive process for securing their networks. The company\u0027s flagship\nproduct, CORE IMPACT, is the most comprehensive product for performing\nenterprise security assurance testing. CORE IMPACT evaluates network,\nendpoint and end-user vulnerabilities and identifies what resources are\nexposed. It enables organizations to determine if current security\ninvestments are detecting and preventing attacks. Core Security\nTechnologies augments its leading technology solution with world-class\nsecurity consulting services, including penetration testing and software\nsecurity auditing. Based in Boston, MA and Buenos Aires, Argentina, Core\nSecurity Technologies can be reached at 617-399-6980 or on the Web at\nhttp://www.coresecurity.com. \n\n\n*Disclaimer*\n\nThe contents of this advisory are copyright (c) 2008 Core Security\nTechnologies and (c) 2008 CoreLabs, and may be distributed freely\nprovided that no fee is charged for this distribution and proper credit\nis given. \n\n\n*GPG/PGP Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.7 (MingW32)\nComment: Using GnuPG with Mozilla - http://enigmail.mozdev.org\n\niD8DBQFIH2eAyNibggitWa0RAtlcAKCgV83vS0v4aLVTRtFmkBsEg0UPXgCdHL4p\nsi+I8mGJwJuglh+QESsZ9ZE=\n=705O\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"db": "CERT/CC",
"id": "VU#596268"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"db": "CNVD",
"id": "CNVD-2008-2191"
},
{
"db": "BID",
"id": "28974"
},
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "PACKETSTORM",
"id": "66050"
},
{
"db": "PACKETSTORM",
"id": "66028"
}
],
"trust": 3.69
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-2005",
"trust": 3.8
},
{
"db": "BID",
"id": "28974",
"trust": 3.5
},
{
"db": "CERT/CC",
"id": "VU#596268",
"trust": 3.5
},
{
"db": "SECUNIA",
"id": "30063",
"trust": 2.5
},
{
"db": "EXPLOIT-DB",
"id": "6474",
"trust": 2.4
},
{
"db": "SECTRACK",
"id": "1019966",
"trust": 2.4
},
{
"db": "CNVD",
"id": "CNVD-2008-2191",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001354",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20080505 CORE-2008-0129 - WONDERWARE SUITELINK DENIAL OF SERVICE VULNERABILITY",
"trust": 0.6
},
{
"db": "MILW0RM",
"id": "6474",
"trust": 0.6
},
{
"db": "XF",
"id": "42221",
"trust": 0.6
},
{
"db": "IVD",
"id": "DD3E5AD8-23CD-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D7822E1-463F-11E9-8A01-000C29342CB1",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "66050",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "66028",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CERT/CC",
"id": "VU#596268"
},
{
"db": "CNVD",
"id": "CNVD-2008-2191"
},
{
"db": "BID",
"id": "28974"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"db": "PACKETSTORM",
"id": "66050"
},
{
"db": "PACKETSTORM",
"id": "66028"
},
{
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
]
},
"id": "VAR-200805-0133",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2008-2191"
}
],
"trust": 1.6043447333333334
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2008-2191"
}
]
},
"last_update_date": "2023-12-18T12:39:35.284000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Wonderware Tech Alert 106",
"trust": 0.8,
"url": "http://www.wonderware.com/support/mmi/comprehensive/kbcd/html/t002260.htm"
},
{
"title": "Wonderware Security Manual - Securing Industrial Control Systems",
"trust": 0.8,
"url": "http://www.wonderware.com/support/mmi/esupport/securitycentral/documents/bestpractices/wwsecgd041707_external.pdf"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"db": "NVD",
"id": "CVE-2008-2005"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "http://www.securityfocus.com/bid/28974"
},
{
"trust": 2.7,
"url": "http://www.kb.cert.org/vuls/id/596268"
},
{
"trust": 2.5,
"url": "http://www.coresecurity.com/?action=item\u0026id=2187"
},
{
"trust": 2.4,
"url": "http://www.securitytracker.com/id?1019966"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/30063"
},
{
"trust": 1.4,
"url": "http://www.milw0rm.com/exploits/6474"
},
{
"trust": 1.0,
"url": "http://www.wonderware.com/support/mmi/comprehensive/kbcd/html/t002260.htm"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/archive/1/491623/100/0/threaded"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42221"
},
{
"trust": 1.0,
"url": "https://www.exploit-db.com/exploits/6474"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/30063/"
},
{
"trust": 0.8,
"url": "http://www.wonderware.com/support/web/secure/downloads/download_serve.asp?id=2355\u0026url=http://www.wonderware.com/support/mmi/registered/patchfixes/sl2.0p1.zip"
},
{
"trust": 0.8,
"url": "http://www.wonderware.com/support/mmi/esupport/securitycentral/documents/bestpractices/wwsecgd041707"
},
{
"trust": 0.8,
"url": "http://portal.wonderware.com/sites/securitycentral/default.aspx"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2005"
},
{
"trust": 0.8,
"url": "http://jvn.jp//cert/jvnvu596268/index.html"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2005"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/42221"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/491623/100/0/threaded"
},
{
"trust": 0.4,
"url": "http://us.wonderware.com/"
},
{
"trust": 0.3,
"url": "/archive/1/491623"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/index.php5?module=contentmod\u0026action=item\u0026id=2187"
},
{
"trust": 0.1,
"url": "http://secunia.com/network_software_inspector_2/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/16628/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-2005"
},
{
"trust": 0.1,
"url": "http://www.python.org"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "http://enigmail.mozdev.org"
},
{
"trust": 0.1,
"url": "http://www.wonderware.com/support/mmi/esupport/securitycentral/documents/bestpractices/wwsecgd041707_external.pdf"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/corelabs/."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/corelabs/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#596268"
},
{
"db": "BID",
"id": "28974"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"db": "PACKETSTORM",
"id": "66050"
},
{
"db": "PACKETSTORM",
"id": "66028"
},
{
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CERT/CC",
"id": "VU#596268"
},
{
"db": "CNVD",
"id": "CNVD-2008-2191"
},
{
"db": "BID",
"id": "28974"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"db": "PACKETSTORM",
"id": "66050"
},
{
"db": "PACKETSTORM",
"id": "66028"
},
{
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-04-28T00:00:00",
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"date": "2008-04-28T00:00:00",
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"date": "2008-05-06T00:00:00",
"db": "CERT/CC",
"id": "VU#596268"
},
{
"date": "2008-04-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-2191"
},
{
"date": "2008-05-05T00:00:00",
"db": "BID",
"id": "28974"
},
{
"date": "2008-05-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"date": "2008-05-06T22:57:38",
"db": "PACKETSTORM",
"id": "66050"
},
{
"date": "2008-05-06T20:21:55",
"db": "PACKETSTORM",
"id": "66028"
},
{
"date": "2008-05-06T15:20:00",
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"date": "2008-04-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-09-17T00:00:00",
"db": "CERT/CC",
"id": "VU#596268"
},
{
"date": "2008-04-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-2191"
},
{
"date": "2008-09-17T18:10:00",
"db": "BID",
"id": "28974"
},
{
"date": "2008-05-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001354"
},
{
"date": "2018-10-11T20:38:45.373000",
"db": "NVD",
"id": "CVE-2008-2005"
},
{
"date": "2009-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "66028"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WonderWare SuiteLink slssvc.exe Remote Denial of Service Vulnerability",
"sources": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2008-2191"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Resource management error",
"sources": [
{
"db": "IVD",
"id": "dd3e5ad8-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d7822e1-463f-11e9-8a01-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-200805-037"
}
],
"trust": 1.0
}
}
VAR-200203-0070
Vulnerability from variot - Updated: 2023-12-18 12:33Siemens 3568i WAP mobile phones allows remote attackers to cause a denial of service (crash) via an SMS message containing unusual characters. Siemens has a certain number of user groups for the production of various types of mobile phone products.
Some models of Siemens phones have problems with the short message processing function. Malicious attackers can use this vulnerability to make the phone unable to receive short messages.
When the mobile phone receives SMS short messages that contain certain illegal characters, the mobile phone will shut down by mistake when trying to view these messages. Because some models of mobile phones can only be viewed before deleting, these malicious short messages cannot be deleted. When the receiving queue of the mobile phone is filled with malicious short messages, the mobile phone cannot continue to receive short messages. If enough messages are sent, SMS functionality may be completely denied
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200203-0070",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "3568i wap",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": "0.0"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "3568i wap",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "sl45/6688",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0057"
},
{
"db": "BID",
"id": "3870"
},
{
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:3568i_wap:0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0122"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "benjurry\u203b benjurry@263.net",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
],
"trust": 0.6
},
"cve": "CVE-2002-0122",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2002-0122",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200203-084",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens 3568i WAP mobile phones allows remote attackers to cause a denial of service (crash) via an SMS message containing unusual characters. Siemens has a certain number of user groups for the production of various types of mobile phone products. \n\n\u00a0Some models of Siemens phones have problems with the short message processing function. Malicious attackers can use this vulnerability to make the phone unable to receive short messages. \n\n\u00a0When the mobile phone receives SMS short messages that contain certain illegal characters, the mobile phone will shut down by mistake when trying to view these messages. Because some models of mobile phones can only be viewed before deleting, these malicious short messages cannot be deleted. When the receiving queue of the mobile phone is filled with malicious short messages, the mobile phone cannot continue to receive short messages. If enough messages are sent, SMS functionality may be completely denied",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"db": "CNVD",
"id": "CNVD-2002-0057"
},
{
"db": "BID",
"id": "3870"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2002-0122",
"trust": 2.5
},
{
"db": "BID",
"id": "3870",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2002-0057",
"trust": 0.6
},
{
"db": "XF",
"id": "7902",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20020114 SIEMENS MOBIE SMS EXCEPTIONAL CHARACTER VULNERABILITY",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200203-084",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0057"
},
{
"db": "BID",
"id": "3870"
},
{
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
]
},
"id": "VAR-200203-0070",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0057"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0057"
}
]
},
"last_update_date": "2023-12-18T12:33:16.500000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0122"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://online.securityfocus.com/archive/1/250115"
},
{
"trust": 1.6,
"url": "http://www.iss.net/security_center/static/7902.php"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/3870"
},
{
"trust": 0.3,
"url": "http://www.siemens.com/page/1,3771,257605-1-999_0_0-0,00.html"
},
{
"trust": 0.3,
"url": "http://www.siemens.com/page/1,3771,257599-1-999_0_0-0,00.html"
}
],
"sources": [
{
"db": "BID",
"id": "3870"
},
{
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2002-0057"
},
{
"db": "BID",
"id": "3870"
},
{
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-01-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-0057"
},
{
"date": "2002-01-13T00:00:00",
"db": "BID",
"id": "3870"
},
{
"date": "2002-03-25T05:00:00",
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"date": "2002-01-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-01-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-0057"
},
{
"date": "2009-07-11T09:56:00",
"db": "BID",
"id": "3870"
},
{
"date": "2008-09-11T00:00:32.930000",
"db": "NVD",
"id": "CVE-2002-0122"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens Mobile Phone Short Message Denial of Service Attack Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0057"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200203-084"
}
],
"trust": 0.6
}
}
VAR-200303-0053
Vulnerability from variot - Updated: 2023-12-18 12:33Cisco ONS15454 and ONS15327 running ONS before 3.4 have an account for the VxWorks Operating System in the TCC, TCC+ and XTC that cannot be changed or disabled, which allows remote attackers to gain privileges by connecting to the account via Telnet. Cisco ONS15454 and Cisco ONS15327 are optical fiber network platforms developed by CISCO.
Cisco ONS 15454 and Cisco ONS 15327 devices have default accounts. Remote attackers can use this vulnerability to gain unauthorized access and take complete control of the device.
TCC, TCC + and XTC contain a default username and password. This account can be used to access the VxWorks operating system, and this account cannot be changed or closed. Using this account, an attacker can remotely access through the Telnet service and take complete control of the device.
The vulnerability CISCO BUG ID is: CSCdy70756
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200303-0053",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "optical networking systems software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2.0"
},
{
"model": "optical networking systems software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.2"
},
{
"model": "optical networking systems software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.3.0"
},
{
"model": "optical networking systems software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "optical networking systems software",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "3.1.0"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "ons 15327",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.1"
},
{
"model": "ons 15454 optical transport platform",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.2.0"
},
{
"model": "ons 15327",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.2"
},
{
"model": "ons 15454 optical transport platform",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.1.0"
},
{
"model": "ons 15454 optical transport platform",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "ons 15454 optical transport platform",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.3"
},
{
"model": "ons 15327",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "ons 15327",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "3.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "optical networking",
"version": "3.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "optical networking",
"version": "3.1.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "optical networking",
"version": "3.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "optical networking",
"version": "3.2.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "optical networking",
"version": "3.3.0"
},
{
"model": "ons optical transport platform",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "154543.3"
},
{
"model": "ons optical transport platform",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "154543.2.0"
},
{
"model": "ons optical transport platform",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "154543.1.0"
},
{
"model": "ons optical transport platform",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "154543.0"
},
{
"model": "ons",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "153273.3"
},
{
"model": "ons",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "153273.2"
},
{
"model": "ons",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "153273.1"
},
{
"model": "ons",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "153273.0"
},
{
"model": "ons optical transport platform",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "154543.4"
},
{
"model": "ons",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "153273.4"
}
],
"sources": [
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2002-3962"
},
{
"db": "BID",
"id": "6083"
},
{
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:optical_networking_systems_software:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:optical_networking_systems_software:3.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:optical_networking_systems_software:3.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:optical_networking_systems_software:3.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:optical_networking_systems_software:3.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-1558"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "This issue was reported in a Cisco Security Advisory.",
"sources": [
{
"db": "BID",
"id": "6083"
}
],
"trust": 0.3
},
"cve": "CVE-2002-1558",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-5943",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2002-1558",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200303-117",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-5943",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-5943"
},
{
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco ONS15454 and ONS15327 running ONS before 3.4 have an account for the VxWorks Operating System in the TCC, TCC+ and XTC that cannot be changed or disabled, which allows remote attackers to gain privileges by connecting to the account via Telnet. Cisco ONS15454 and Cisco ONS15327 are optical fiber network platforms developed by CISCO. \n\n\u00a0Cisco ONS 15454 and Cisco ONS 15327 devices have default accounts. Remote attackers can use this vulnerability to gain unauthorized access and take complete control of the device. \n\n\u00a0TCC, TCC + and XTC contain a default username and password. This account can be used to access the VxWorks operating system, and this account cannot be changed or closed. Using this account, an attacker can remotely access through the Telnet service and take complete control of the device. \n\n\u00a0The vulnerability CISCO BUG ID is: CSCdy70756",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"db": "CNVD",
"id": "CNVD-2002-3962"
},
{
"db": "BID",
"id": "6083"
},
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-5943"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2002-1558",
"trust": 3.0
},
{
"db": "BID",
"id": "6083",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200303-117",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2002-3962",
"trust": 1.0
},
{
"db": "XF",
"id": "10510",
"trust": 0.6
},
{
"db": "CISCO",
"id": "20021031 CISCO ONS15454 AND CISCO ONS15327 VULNERABILITIES",
"trust": 0.6
},
{
"db": "IVD",
"id": "C7E75360-23CD-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "7D72F2C1-463F-11E9-AF27-000C29342CB1",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-5943",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2002-3962"
},
{
"db": "VULHUB",
"id": "VHN-5943"
},
{
"db": "BID",
"id": "6083"
},
{
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
]
},
"id": "VAR-200303-0053",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2002-3962"
},
{
"db": "VULHUB",
"id": "VHN-5943"
}
],
"trust": 0.11000000000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.4
}
],
"sources": [
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2002-3962"
}
]
},
"last_update_date": "2023-12-18T12:33:08.551000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-1558"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/6083"
},
{
"trust": 1.7,
"url": "http://www.cisco.com/warp/public/707/ons-multiple-vuln-pub.shtml"
},
{
"trust": 1.7,
"url": "http://www.iss.net/security_center/static/10510.php"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-5943"
},
{
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2002-3962"
},
{
"db": "VULHUB",
"id": "VHN-5943"
},
{
"db": "BID",
"id": "6083"
},
{
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-10-31T00:00:00",
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"date": "2002-10-31T00:00:00",
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"date": "2002-10-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-3962"
},
{
"date": "2003-03-31T00:00:00",
"db": "VULHUB",
"id": "VHN-5943"
},
{
"date": "2002-10-31T00:00:00",
"db": "BID",
"id": "6083"
},
{
"date": "2003-03-31T05:00:00",
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"date": "2002-10-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-10-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-3962"
},
{
"date": "2018-10-30T00:00:00",
"db": "VULHUB",
"id": "VHN-5943"
},
{
"date": "2009-07-11T18:06:00",
"db": "BID",
"id": "6083"
},
{
"date": "2018-10-30T16:26:17.187000",
"db": "NVD",
"id": "CVE-2002-1558"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco ONS15454 / ONS15327 Fibre Transport Platform Default Account Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-3962"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design error",
"sources": [
{
"db": "IVD",
"id": "c7e75360-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "7d72f2c1-463f-11e9-af27-000c29342cb1"
},
{
"db": "BID",
"id": "6083"
},
{
"db": "CNNVD",
"id": "CNNVD-200303-117"
}
],
"trust": 1.3
}
}
VAR-200801-0248
Vulnerability from variot - Updated: 2023-12-18 12:31Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory. An attacker can run an executable server-side script ( Example: Windows Internet Information Server of ASP shell Etc.) or execute arbitrary commands with web server execution privileges. GE Fanuc Proficy Information Portal Is a web-based system status reporting system that connects production information systems and inter-enterprise networks and handles data such as production information online. This action could allow an attacker to access a vulnerable production information system.
The Proficy Real-Time Information Portal has a vulnerability in processing user requests, and remote attackers could use this vulnerability to control the server.
Proficy Real-Time Information Portal does not perform the correct Java RMI call to Add WebSource, allowing the user to set the name and path of the file location, and another parameter of the file itself is the base64-encoded content. A successful exploit can allow an attacker to upload arbitrary scripts and execute them in the context of the application. Proficy Real Time Information Portal 2.6 is vulnerable; other versions may also be affected. Background
GE-Fanuc's Proficy Information Portal 2.6 is a web based reporting application for the SCADA environment. As such it will usually be installed in a buffer zone between the SCADA and the corporate network, which makes it a very sensitive application as it can reach both networks.
Impact
An authenticated attacker can compromise the server running Proficy Information Portal, enabling him to progress to the control/process network.
Workaround/Fix
Vendor fix will be available by Feb 15th. A possible workaround is to remove the write permission of the IIS user from the Proficy directory.
Additional Information
For additional information please contact us at info@c4-security.com. Note that we will respond only to verified utility personnel and governmental agencies. The CVE identifier assigned to this vulnerability by CERT is CVE-2008-0175
Credit
This vulnerability was discovered and exploited by Eyal Udassin of C4.
Regards,
Eyal Udassin - C4 (Formerly Swift Coders) 33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel eyal.udassin@c4-security.com / www.c4-security.com http://www.c4-security.com/ +972-547-684989 .
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched.
Download and test it today: https://psi.secunia.com/
Read more about this new version: https://psi.secunia.com/?page=changelog
TITLE: Proficy Real-Time Information Portal "Add WebSource" File Upload Vulnerability
SECUNIA ADVISORY ID: SA28678
VERIFY ADVISORY: http://secunia.com/advisories/28678/
CRITICAL: Less critical
IMPACT: System access
WHERE:
From local network
SOFTWARE: Proficy Real-Time Information Portal 2.x http://secunia.com/product/17343/
DESCRIPTION: Eyal Udassin has reported a vulnerability in Proficy Real-Time Information Portal, which can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to an error in the "Add WebSource" feature when handling file uploads. This can be exploited to e.g.
The vulnerability is reported in version 2.6. Other versions may also be affected.
SOLUTION: The vendor will reportedly release a SIM (Software Improvement Module) by February 15, 2008.
PROVIDED AND/OR DISCOVERED BY: Eyal Udassin, C4 Security
ORIGINAL ADVISORY: GE Fanuc (KB12460): http://support.gefanuc.com/support/index?page=kbchannel&id=KB12460
C4 Security (via BugTraq): http://archives.neohapsis.com/archives/bugtraq/2008-01/0373.html
OTHER REFERENCES: US-CERT VU#339345: http://www.kb.cert.org/vuls/id/339345
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200801-0248",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "proficy real-time information portal",
"scope": "lte",
"trust": 1.8,
"vendor": "ge fanuc",
"version": "2.6"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ge fanuc",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "proficy real-time information portal",
"scope": "eq",
"trust": 0.6,
"vendor": "ge fanuc",
"version": "2.6"
},
{
"model": "fanuc proficy real-time information portal",
"scope": "eq",
"trust": 0.3,
"vendor": "ge",
"version": "2.6"
},
{
"model": "fanuc proficy real-time information portal",
"scope": "eq",
"trust": 0.3,
"vendor": "ge",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "proficy real time information portal",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#339345"
},
{
"db": "CNVD",
"id": "CNVD-2008-0433"
},
{
"db": "BID",
"id": "27446"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ge_fanuc:proficy_real-time_information_portal:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.6",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-0175"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Eyal Udassin of C4",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
],
"trust": 0.6
},
"cve": "CVE-2008-0175",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2008-0175",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "06837a6c-2352-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-0175",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#339345",
"trust": 0.8,
"value": "0.84"
},
{
"author": "CNNVD",
"id": "CNNVD-200801-409",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#339345"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory. An attacker can run an executable server-side script ( Example: Windows Internet Information Server of ASP shell Etc.) or execute arbitrary commands with web server execution privileges. GE Fanuc Proficy Information Portal Is a web-based system status reporting system that connects production information systems and inter-enterprise networks and handles data such as production information online. This action could allow an attacker to access a vulnerable production information system. \n\n\u00a0The Proficy Real-Time Information Portal has a vulnerability in processing user requests, and remote attackers could use this vulnerability to control the server. \n\n\u00a0Proficy Real-Time Information Portal does not perform the correct Java RMI call to Add WebSource, allowing the user to set the name and path of the file location, and another parameter of the file itself is the base64-encoded content. \nA successful exploit can allow an attacker to upload arbitrary scripts and execute them in the context of the application. \nProficy Real Time Information Portal 2.6 is vulnerable; other versions may also be affected. Background\n-----------------\nGE-Fanuc\u0027s Proficy Information Portal 2.6 is a web based reporting\napplication for the SCADA environment. As such it will usually be installed\nin a buffer zone between the SCADA and the corporate network, which makes it\na very sensitive application as it can reach both networks. \n\nImpact\n----------\nAn authenticated attacker can compromise the server running Proficy\nInformation Portal, enabling him to progress to the control/process network. \n \nWorkaround/Fix\n-----------------------\nVendor fix will be available by Feb 15th. \nA possible workaround is to remove the write permission of the IIS user from\nthe Proficy directory. \n \nAdditional Information\n-------------------------------\nFor additional information please contact us at info@c4-security.com. Note\nthat we will respond only to verified utility personnel and governmental\nagencies. \nThe CVE identifier assigned to this vulnerability by CERT is CVE-2008-0175\n \nCredit\n--------\nThis vulnerability was discovered and exploited by Eyal Udassin of C4. \n \nRegards,\n \nEyal Udassin - C4 (Formerly Swift Coders)\n33 Jabotinsky St. The Twin Towers #1, Ramat Gan, Israel\neyal.udassin@c4-security.com / www.c4-security.com\n\u003chttp://www.c4-security.com/\u003e \n+972-547-684989\n. \n\n----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \n\nDownload and test it today:\nhttps://psi.secunia.com/\n\nRead more about this new version:\nhttps://psi.secunia.com/?page=changelog\n\n----------------------------------------------------------------------\n\nTITLE:\nProficy Real-Time Information Portal \"Add WebSource\" File Upload\nVulnerability\n\nSECUNIA ADVISORY ID:\nSA28678\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/28678/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom local network\n\nSOFTWARE:\nProficy Real-Time Information Portal 2.x\nhttp://secunia.com/product/17343/\n\nDESCRIPTION:\nEyal Udassin has reported a vulnerability in Proficy Real-Time\nInformation Portal, which can be exploited by malicious users to\ncompromise a vulnerable system. \n\nThe vulnerability is caused due to an error in the \"Add WebSource\"\nfeature when handling file uploads. This can be exploited to e.g. \n\nThe vulnerability is reported in version 2.6. Other versions may also\nbe affected. \n\nSOLUTION:\nThe vendor will reportedly release a SIM (Software Improvement\nModule) by February 15, 2008. \n\nPROVIDED AND/OR DISCOVERED BY:\nEyal Udassin, C4 Security\n\nORIGINAL ADVISORY:\nGE Fanuc (KB12460):\nhttp://support.gefanuc.com/support/index?page=kbchannel\u0026id=KB12460\n\nC4 Security (via BugTraq):\nhttp://archives.neohapsis.com/archives/bugtraq/2008-01/0373.html\n\nOTHER REFERENCES:\nUS-CERT VU#339345:\nhttp://www.kb.cert.org/vuls/id/339345\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"db": "CERT/CC",
"id": "VU#339345"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"db": "CNVD",
"id": "CNVD-2008-0433"
},
{
"db": "BID",
"id": "27446"
},
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "63005"
},
{
"db": "PACKETSTORM",
"id": "63060"
}
],
"trust": 3.51
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-0175",
"trust": 3.6
},
{
"db": "CERT/CC",
"id": "VU#339345",
"trust": 3.0
},
{
"db": "BID",
"id": "27446",
"trust": 2.7
},
{
"db": "SECUNIA",
"id": "28678",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1019274",
"trust": 2.4
},
{
"db": "VUPEN",
"id": "ADV-2008-0307",
"trust": 1.6
},
{
"db": "SREASON",
"id": "3591",
"trust": 1.6
},
{
"db": "CNVD",
"id": "CNVD-2008-0433",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200801-409",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "0811",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001055",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20080125 C4 SECURITY ADVISORY - GE FANUC PROFICY INFORMATION PORTAL 2.6 ARBITRARY FILE UPLOAD AND EXECUTION",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080129 RE: C4 SECURITY ADVISORY - GE FANUC PROFICY INFORMATION PORTAL 2.6 ARBITRARY FILE UPLOAD AND EXECUTION",
"trust": 0.6
},
{
"db": "IVD",
"id": "06837A6C-2352-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "63005",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "63060",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#339345"
},
{
"db": "CNVD",
"id": "CNVD-2008-0433"
},
{
"db": "BID",
"id": "27446"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"db": "PACKETSTORM",
"id": "63005"
},
{
"db": "PACKETSTORM",
"id": "63060"
},
{
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
]
},
"id": "VAR-200801-0248",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2008-0433"
}
],
"trust": 1.1820513
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2008-0433"
}
]
},
"last_update_date": "2023-12-18T12:31:52.906000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Securing Your HMI/SCADA Systems",
"trust": 0.8,
"url": "http://www.gefanuc.com/as_en/gefanuc/resource_center/hmi_scada/hmiscada_security.html"
},
{
"title": "KB12460",
"trust": 0.8,
"url": "http://support.gefanuc.com/support/index?page=kbchannel\u0026id=kb12460"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"db": "NVD",
"id": "CVE-2008-0175"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://support.gefanuc.com/support/index?page=kbchannel\u0026id=kb12460"
},
{
"trust": 2.4,
"url": "http://secunia.com/advisories/28678"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/27446"
},
{
"trust": 2.4,
"url": "http://www.securitytracker.com/id?1019274"
},
{
"trust": 2.2,
"url": "http://www.kb.cert.org/vuls/id/339345"
},
{
"trust": 1.6,
"url": "http://securityreason.com/securityalert/3591"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/archive/1/487079/100/0/threaded"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/archive/1/487242/100/0/threaded"
},
{
"trust": 1.0,
"url": "http://www.vupen.com/english/advisories/2008/0307/references"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/archive/1/487079/30/0/threaded"
},
{
"trust": 0.8,
"url": "http://packetstormsecurity.org/0811-exploits/hooked_on_fanucs.rb.txt"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0175"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu%23339345/index.html"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0175"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/487079/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/487242/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/0307/references"
},
{
"trust": 0.3,
"url": "http://www.us-cert.gov/current/index.html#ge_fanuc_product_vulnerabilities"
},
{
"trust": 0.3,
"url": "http://www.gefanuc.com/as_en/products_solutions/production_management/products/proficy_portal.html"
},
{
"trust": 0.3,
"url": "/archive/1/487079"
},
{
"trust": 0.3,
"url": "/archive/1/487242"
},
{
"trust": 0.1,
"url": "http://www.c4-security.com/\u003e"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-0175"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17343/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/?page=changelog"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/28678/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/bugtraq/2008-01/0373.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#339345"
},
{
"db": "BID",
"id": "27446"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"db": "PACKETSTORM",
"id": "63005"
},
{
"db": "PACKETSTORM",
"id": "63060"
},
{
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#339345"
},
{
"db": "CNVD",
"id": "CNVD-2008-0433"
},
{
"db": "BID",
"id": "27446"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"db": "PACKETSTORM",
"id": "63005"
},
{
"db": "PACKETSTORM",
"id": "63060"
},
{
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-01-24T00:00:00",
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"date": "2008-01-25T00:00:00",
"db": "CERT/CC",
"id": "VU#339345"
},
{
"date": "2008-01-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-0433"
},
{
"date": "2008-01-24T00:00:00",
"db": "BID",
"id": "27446"
},
{
"date": "2008-02-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"date": "2008-01-26T00:12:46",
"db": "PACKETSTORM",
"id": "63005"
},
{
"date": "2008-01-29T00:00:58",
"db": "PACKETSTORM",
"id": "63060"
},
{
"date": "2008-01-29T02:00:00",
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"date": "2008-01-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-12-18T00:00:00",
"db": "CERT/CC",
"id": "VU#339345"
},
{
"date": "2008-01-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-0433"
},
{
"date": "2008-11-04T17:55:00",
"db": "BID",
"id": "27446"
},
{
"date": "2008-02-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001055"
},
{
"date": "2018-10-15T21:58:24.843000",
"db": "NVD",
"id": "CVE-2008-0175"
},
{
"date": "2008-09-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GE-Fanuc Proficy Real-Time Information Portal Remote script upload and execution vulnerability",
"sources": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2008-0433"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design error",
"sources": [
{
"db": "IVD",
"id": "06837a6c-2352-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-200801-409"
}
],
"trust": 0.8
}
}
VAR-200001-0040
Vulnerability from variot - Updated: 2023-12-18 12:24cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to read arbitrary files by specifying the filename in a parameter to the script. The Contivity series is an external network switch product developed by Nortel. The newer Contivity switch includes an httpd server running on the VxWorks operating system to provide a remote Web-based management interface.
A vulnerability exists in the "cgiproc" script implementation of the Web management interface of the Contivity series switches. A remote attacker could use this vulnerability to conduct a denial of service attack on the switch or view arbitrary system files.
Because the user input is not sufficiently filtered, if you pass metacharacters to the cgiporc program, such as "!" Or "$", the system will crash. Another vulnerability of cgiproc is the lack of authentication when requesting a management page. This enables an attacker to view any file in the web server. A total system crash can occur as a result of exploiting a vulnerability in a cgi-bin program called "cgiproc" that is included with the webserver. If metacharacters such as "!", or "$" are passed to cgiproc, the system will crash (because the characters are not escaped). foo foo@blacklisted.intranova.net provided the following example: http://x.x.x.x/manage/cgi/cgiproc?$ [crash] No evidence of this problem being exploited is saved in the logs. foo foo@blacklisted.intranova.net also provided an example for this vulnerability: http://x.x.x.x/manage/cgi/cgiproc?Nocfile=/name/and/path/of/file. (interesting places to look: /system/filelist.dat, /system/version.dat, /system/keys, /system/core, etc.) All that is written to the logs when this is exploited is below: 09:44:23 tEvtLgMgr 0 : Security [12] Management: Request for cgiproc denied. requires login In order to perform the operations detailed in the report, the "attackers" must be internal, private side users or authenticated tunnel users and the site administrator must allow them HTTP as a management protocol
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200001-0040",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "contivity",
"scope": "eq",
"trust": 1.6,
"vendor": "nortel",
"version": "1.0"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "networks contivity extranet switch",
"scope": "eq",
"trust": 0.3,
"vendor": "nortel",
"version": "2500"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nortel:contivity:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2000-0063"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "foo foo@blacklisted.intranova.net",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
],
"trust": 0.6
},
"cve": "CVE-2000-0063",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "663d977a-2079-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-1642",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2000-0063",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200001-039",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-1642",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-1642"
},
{
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to read arbitrary files by specifying the filename in a parameter to the script. The Contivity series is an external network switch product developed by Nortel. The newer Contivity switch includes an httpd server running on the VxWorks operating system to provide a remote Web-based management interface. \n\n\u00a0A vulnerability exists in the \"cgiproc\" script implementation of the Web management interface of the Contivity series switches. A remote attacker could use this vulnerability to conduct a denial of service attack on the switch or view arbitrary system files. \n\n\u00a0Because the user input is not sufficiently filtered, if you pass metacharacters to the cgiporc program, such as \"!\" Or \"$\", the system will crash. Another vulnerability of cgiproc is the lack of authentication when requesting a management page. This enables an attacker to view any file in the web server. A total system crash can occur as a result of exploiting a vulnerability in a cgi-bin program called \"cgiproc\" that is included with the webserver. If metacharacters such as \"!\", or \"$\" are passed to cgiproc, the system will crash (because the characters are not escaped). \nfoo \u003cfoo@blacklisted.intranova.net\u003e provided the following example:\nhttp://x.x.x.x/manage/cgi/cgiproc?$\n[crash]\nNo evidence of this problem being exploited is saved in the logs. \nfoo \u003cfoo@blacklisted.intranova.net\u003e also provided an example for this vulnerability:\nhttp://x.x.x.x/manage/cgi/cgiproc?Nocfile=/name/and/path/of/file. \n(interesting places to look: /system/filelist.dat, /system/version.dat, /system/keys, /system/core, etc.)\nAll that is written to the logs when this is exploited is below:\n09:44:23 tEvtLgMgr 0 : Security [12] Management: Request for cgiproc denied. requires login\nIn order to perform the operations detailed in the report, the \"attackers\" must be internal, private side users or authenticated tunnel users and the site administrator must allow them HTTP as a management protocol",
"sources": [
{
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "BID",
"id": "938"
},
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-1642"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2000-0063",
"trust": 2.7
},
{
"db": "BID",
"id": "938",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200001-039",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2001-0323",
"trust": 1.0
},
{
"db": "NSFOCUS",
"id": "257",
"trust": 0.6
},
{
"db": "IVD",
"id": "7D77FBD3-463F-11E9-88DF-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "663D977A-2079-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-1642",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "VULHUB",
"id": "VHN-1642"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
]
},
"id": "VAR-200001-0040",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "VULHUB",
"id": "VHN-1642"
}
],
"trust": 0.11000000000000001
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2001-0323"
}
]
},
"last_update_date": "2023-12-18T12:24:53.996000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2000-0063"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/938"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/257"
},
{
"trust": 0.3,
"url": "http://www.nortelnetworks.com/products/01/contivity/index.html"
},
{
"trust": 0.1,
"url": ""
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-1642"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "VULHUB",
"id": "VHN-1642"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-01-19T00:00:00",
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"date": "2001-01-19T00:00:00",
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"date": "2001-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"date": "2000-01-17T00:00:00",
"db": "VULHUB",
"id": "VHN-1642"
},
{
"date": "2000-01-18T00:00:00",
"db": "BID",
"id": "938"
},
{
"date": "2000-01-17T05:00:00",
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"date": "2000-01-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"date": "2008-09-10T00:00:00",
"db": "VULHUB",
"id": "VHN-1642"
},
{
"date": "2000-01-18T00:00:00",
"db": "BID",
"id": "938"
},
{
"date": "2008-09-10T19:02:41.913000",
"db": "NVD",
"id": "CVE-2000-0063"
},
{
"date": "2006-08-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Nortel Contivity Switch Remote Denial of Service Attack and File Leak Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2001-0323"
}
],
"trust": 1.0
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "IVD",
"id": "7d77fbd3-463f-11e9-88df-000c29342cb1"
},
{
"db": "IVD",
"id": "663d977a-2079-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-039"
}
],
"trust": 1.0
}
}
VAR-200001-0041
Vulnerability from variot - Updated: 2023-12-18 12:24cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters. The Contivity series is an external network switch product developed by Nortel. The newer Contivity switch includes an httpd server running on the VxWorks operating system to provide a remote Web-based management interface.
A vulnerability exists in the "cgiproc" script implementation of the Web management interface of the Contivity series switches. A remote attacker could use this vulnerability to conduct a denial of service attack on the switch or view arbitrary system files.
Because the user input is not sufficiently filtered, if you pass metacharacters to the cgiporc program, such as "!" Or "$", the system will crash. Another vulnerability of cgiproc is the lack of authentication when requesting a management page. This enables an attacker to view any file in the web server. A total system crash can occur as a result of exploiting a vulnerability in a cgi-bin program called "cgiproc" that is included with the webserver. If metacharacters such as "!", or "$" are passed to cgiproc, the system will crash (because the characters are not escaped). foo foo@blacklisted.intranova.net provided the following example: http://x.x.x.x/manage/cgi/cgiproc?$ [crash] No evidence of this problem being exploited is saved in the logs. foo foo@blacklisted.intranova.net also provided an example for this vulnerability: http://x.x.x.x/manage/cgi/cgiproc?Nocfile=/name/and/path/of/file. (interesting places to look: /system/filelist.dat, /system/version.dat, /system/keys, /system/core, etc.) All that is written to the logs when this is exploited is below: 09:44:23 tEvtLgMgr 0 : Security [12] Management: Request for cgiproc denied. requires login In order to perform the operations detailed in the report, the "attackers" must be internal, private side users or authenticated tunnel users and the site administrator must allow them HTTP as a management protocol
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200001-0041",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "contivity",
"scope": "eq",
"trust": 1.6,
"vendor": "nortel",
"version": "1.0"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "networks contivity extranet switch",
"scope": "eq",
"trust": 0.3,
"vendor": "nortel",
"version": "2500"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nortel:contivity:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2000-0064"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "foo foo@blacklisted.intranova.net",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
],
"trust": 0.6
},
"cve": "CVE-2000-0064",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-1643",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2000-0064",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200001-041",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-1643",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-1643"
},
{
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters. The Contivity series is an external network switch product developed by Nortel. The newer Contivity switch includes an httpd server running on the VxWorks operating system to provide a remote Web-based management interface. \n\n\u00a0A vulnerability exists in the \"cgiproc\" script implementation of the Web management interface of the Contivity series switches. A remote attacker could use this vulnerability to conduct a denial of service attack on the switch or view arbitrary system files. \n\n\u00a0Because the user input is not sufficiently filtered, if you pass metacharacters to the cgiporc program, such as \"!\" Or \"$\", the system will crash. Another vulnerability of cgiproc is the lack of authentication when requesting a management page. This enables an attacker to view any file in the web server. A total system crash can occur as a result of exploiting a vulnerability in a cgi-bin program called \"cgiproc\" that is included with the webserver. If metacharacters such as \"!\", or \"$\" are passed to cgiproc, the system will crash (because the characters are not escaped). \nfoo \u003cfoo@blacklisted.intranova.net\u003e provided the following example:\nhttp://x.x.x.x/manage/cgi/cgiproc?$\n[crash]\nNo evidence of this problem being exploited is saved in the logs. \nfoo \u003cfoo@blacklisted.intranova.net\u003e also provided an example for this vulnerability:\nhttp://x.x.x.x/manage/cgi/cgiproc?Nocfile=/name/and/path/of/file. \n(interesting places to look: /system/filelist.dat, /system/version.dat, /system/keys, /system/core, etc.)\nAll that is written to the logs when this is exploited is below:\n09:44:23 tEvtLgMgr 0 : Security [12] Management: Request for cgiproc denied. requires login\nIn order to perform the operations detailed in the report, the \"attackers\" must be internal, private side users or authenticated tunnel users and the site administrator must allow them HTTP as a management protocol",
"sources": [
{
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "BID",
"id": "938"
},
{
"db": "VULHUB",
"id": "VHN-1643"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2000-0064",
"trust": 2.3
},
{
"db": "BID",
"id": "938",
"trust": 2.0
},
{
"db": "OSVDB",
"id": "7583",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200001-041",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2001-0323",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "257",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-1643",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "VULHUB",
"id": "VHN-1643"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
]
},
"id": "VAR-200001-0041",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "VULHUB",
"id": "VHN-1643"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-0323"
}
]
},
"last_update_date": "2023-12-18T12:24:53.968000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2000-0064"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/938"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/7583"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/257"
},
{
"trust": 0.3,
"url": "http://www.nortelnetworks.com/products/01/contivity/index.html"
},
{
"trust": 0.1,
"url": ""
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-1643"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"db": "VULHUB",
"id": "VHN-1643"
},
{
"db": "BID",
"id": "938"
},
{
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"date": "2000-01-17T00:00:00",
"db": "VULHUB",
"id": "VHN-1643"
},
{
"date": "2000-01-18T00:00:00",
"db": "BID",
"id": "938"
},
{
"date": "2000-01-17T05:00:00",
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"date": "2000-01-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-01-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2001-0323"
},
{
"date": "2008-09-10T00:00:00",
"db": "VULHUB",
"id": "VHN-1643"
},
{
"date": "2000-01-18T00:00:00",
"db": "BID",
"id": "938"
},
{
"date": "2008-09-10T19:02:41.993000",
"db": "NVD",
"id": "CVE-2000-0064"
},
{
"date": "2006-08-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Nortel Contivity Switch Remote Denial of Service Attack and File Leak Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2001-0323"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200001-041"
}
],
"trust": 0.6
}
}
VAR-200212-0041
Vulnerability from variot - Updated: 2023-12-18 12:24Linksys EtherFast Cable/DSL BEFSR11, BEFSR41 and BEFSRU31 with the firmware 1.42.7 upgrade installed opens TCP port 5678 for remote administration even when the "Block WAN" and "Remote Admin" options are disabled, which allows remote attackers to gain access. Linksys EtherFast routers is a small four-port router designed to optimize the use of DSL or Cable connections.
This vulnerability is not present in other versions of firmware. EtherFast BEFSRU31 Router is prone to a remote security vulnerability. A remote attacker gains access
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200212-0041",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "befsr11",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.42.7"
},
{
"model": "befsr41",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.42.7"
},
{
"model": "befsru31",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.42.7"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "etherfast befsru31 router",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.42.7"
},
{
"model": "etherfast befsr41 router",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.42.7"
},
{
"model": "etherfast befsr11 router",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.42.7"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-2861"
},
{
"db": "BID",
"id": "89532"
},
{
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:befsru31:1.42.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr11:1.42.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr41:1.42.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-2159"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "89532"
}
],
"trust": 0.3
},
"cve": "CVE-2002-2159",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-6542",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2002-2159",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200212-842",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-6542",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-6542"
},
{
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys EtherFast Cable/DSL BEFSR11, BEFSR41 and BEFSRU31 with the firmware 1.42.7 upgrade installed opens TCP port 5678 for remote administration even when the \"Block WAN\" and \"Remote Admin\" options are disabled, which allows remote attackers to gain access. Linksys EtherFast routers is a small four-port router designed to optimize the use of DSL or Cable connections. \n\n\u00a0This vulnerability is not present in other versions of firmware. EtherFast BEFSRU31 Router is prone to a remote security vulnerability. A remote attacker gains access",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"db": "CNVD",
"id": "CNVD-2002-2861"
},
{
"db": "BID",
"id": "89532"
},
{
"db": "VULHUB",
"id": "VHN-6542"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2002-2159",
"trust": 2.6
},
{
"db": "BID",
"id": "4987",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200212-842",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2002-2861",
"trust": 0.6
},
{
"db": "XF",
"id": "9330",
"trust": 0.6
},
{
"db": "BID",
"id": "89532",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-6542",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-2861"
},
{
"db": "VULHUB",
"id": "VHN-6542"
},
{
"db": "BID",
"id": "89532"
},
{
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
]
},
"id": "VAR-200212-0041",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-6542"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:24:44.549000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-2159"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.securityfocus.com/bid/4987"
},
{
"trust": 2.0,
"url": "http://www.securiteam.com/securitynews/5op022k7ge.html"
},
{
"trust": 2.0,
"url": "http://www.iss.net/security_center/static/9330.php"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-6542"
},
{
"db": "BID",
"id": "89532"
},
{
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2002-2861"
},
{
"db": "VULHUB",
"id": "VHN-6542"
},
{
"db": "BID",
"id": "89532"
},
{
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-06-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-2861"
},
{
"date": "2002-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-6542"
},
{
"date": "2002-12-31T00:00:00",
"db": "BID",
"id": "89532"
},
{
"date": "2002-12-31T05:00:00",
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"date": "2002-12-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-06-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-2861"
},
{
"date": "2017-07-12T00:00:00",
"db": "VULHUB",
"id": "VHN-6542"
},
{
"date": "2002-12-31T00:00:00",
"db": "BID",
"id": "89532"
},
{
"date": "2017-07-12T01:29:00.847000",
"db": "NVD",
"id": "CVE-2002-2159"
},
{
"date": "2006-02-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "LinkSys EtherFast Router Remote Management Activation Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-2861"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "unknown",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200212-842"
}
],
"trust": 0.6
}
}
VAR-200706-0408
Vulnerability from variot - Updated: 2023-12-18 12:23The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server's IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID. D-Link DPH-540 / DPH-541 are popular wireless internet phone handsets.
There are vulnerabilities in DPH-540 / DPH-541 mobile phones when processing authentication of data requests. Remote attackers may use this vulnerability to send malicious messages to the device. An attacker can exploit this issue to bypass security restrictions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200706-0408",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dph-541",
"scope": "eq",
"trust": 1.6,
"vendor": "d link",
"version": "1.00.14"
},
{
"model": "dph-541",
"scope": "eq",
"trust": 1.6,
"vendor": "d link",
"version": "1.00.03"
},
{
"model": "dph-540",
"scope": "eq",
"trust": 1.6,
"vendor": "d link",
"version": "1.00.14"
},
{
"model": "dph-540",
"scope": "eq",
"trust": 1.6,
"vendor": "d link",
"version": "1.00.03"
},
{
"model": "dph-540",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dph-541",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "dph-540/dph-541",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-2208"
},
{
"db": "BID",
"id": "24560"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dph-541:1.00.03:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:d-link:dph-540:1.00.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:d-link:dph-540:1.00.03:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:d-link:dph-541:1.00.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-3347"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sipera VIPER Lab\u203b viper@sipera.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
],
"trust": 0.6
},
"cve": "CVE-2007-3347",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.8,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2007-3347",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-26709",
"impactScore": 6.9,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:C/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-3347",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200706-363",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-26709",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-26709"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The D-Link DPH-540/DPH-541 phone accepts SIP INVITE messages that are not from the Call Server\u0027s IP address, which allows remote attackers to engage in arbitrary SIP communication with the phone, as demonstrated by communication with forged caller ID. D-Link DPH-540 / DPH-541 are popular wireless internet phone handsets. \n\n\u00a0There are vulnerabilities in DPH-540 / DPH-541 mobile phones when processing authentication of data requests. Remote attackers may use this vulnerability to send malicious messages to the device. \nAn attacker can exploit this issue to bypass security restrictions",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"db": "CNVD",
"id": "CNVD-2007-2208"
},
{
"db": "BID",
"id": "24560"
},
{
"db": "VULHUB",
"id": "VHN-26709"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-3347",
"trust": 3.4
},
{
"db": "BID",
"id": "24560",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "25803",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2007-2320",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002225",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200706-363",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2007-2208",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-26709",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-2208"
},
{
"db": "VULHUB",
"id": "VHN-26709"
},
{
"db": "BID",
"id": "24560"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
]
},
"id": "VAR-200706-0408",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-2208"
},
{
"db": "VULHUB",
"id": "VHN-26709"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-2208"
}
]
},
"last_update_date": "2023-12-18T12:23:33.056000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.dlink.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-3347"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/24560"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/25803"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2007/2320"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35063"
},
{
"trust": 1.0,
"url": "http://www.sipera.com/index.php?action=resources%2cthreat_advisory\u0026tid=219\u0026"
},
{
"trust": 0.9,
"url": "http://www.sipera.com/index.php?action=resources,threat_advisory\u0026tid=219\u0026"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-3347"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-3347"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2007/2320"
},
{
"trust": 0.3,
"url": "http://www.d-link.com/"
},
{
"trust": 0.1,
"url": "http://www.sipera.com/index.php?action=resources,threat_advisory\u0026amp;tid=219\u0026amp;"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-26709"
},
{
"db": "BID",
"id": "24560"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2007-2208"
},
{
"db": "VULHUB",
"id": "VHN-26709"
},
{
"db": "BID",
"id": "24560"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-2208"
},
{
"date": "2007-06-22T00:00:00",
"db": "VULHUB",
"id": "VHN-26709"
},
{
"date": "2007-03-26T00:00:00",
"db": "BID",
"id": "24560"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"date": "2007-06-22T18:30:00",
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"date": "2007-03-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-2208"
},
{
"date": "2017-07-29T00:00:00",
"db": "VULHUB",
"id": "VHN-26709"
},
{
"date": "2007-06-26T23:38:00",
"db": "BID",
"id": "24560"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002225"
},
{
"date": "2023-11-07T02:00:47.930000",
"db": "NVD",
"id": "CVE-2007-3347"
},
{
"date": "2007-06-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DPH-540/DPH-541 Any on the phone SIP Vulnerability used for communication",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002225"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "access verification error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200706-363"
}
],
"trust": 0.6
}
}
VAR-200508-0254
Vulnerability from variot - Updated: 2023-12-18 12:23The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink RTA300W, allows remote attackers to access the Telnet port without authentication via certain packets to the web interface that cause the interface to freeze. The Siemens Santis 50 wireless router is a wi-fi (802.11b) ADSL router for home and small business networks.
Siemens Santis 50 provides a web management interface and a classic telnet CLI for management purposes. These services are only available through the local network by default, but can also be activated through the WAN interface. Siemens Santis 50 Wireless router Web interface is affected by a remote denial of service vulnerability. The attacker can also erase the FLASH contents. Information obtained may be used in further attacks against the vulnerable device or the network it operates on. This issue may also affect the Ericsson HN294dp and Dynalink RTA300W routers. Both devices are believed to use the same hardware as the Siemens Santis 50 Wireless router; this has not been confirmed by Symantec.
Bist Du interessiert an einem neuen Job in IT-Sicherheit?
Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/
TITLE: Siemens Santis 50 Authentication Bypass Vulnerability
SECUNIA ADVISORY ID: SA16215
VERIFY ADVISORY: http://secunia.com/advisories/16215/
CRITICAL: Moderately critical
IMPACT: Security Bypass
WHERE:
From local network
OPERATING SYSTEM: Siemens Santis 50 http://secunia.com/product/5440/
DESCRIPTION: Luca Carettoni has reported a vulnerability in Siemens Santis 50, which can be exploited by malicious people to bypass certain security restrictions. This can reportedly be exploited to view configuration information and potentially erase the device's flash memory.
The vulnerability has been reported in firmware version 4.2.8.0. Other versions may also be affected.
SOLUTION: Restrict access to the device.
PROVIDED AND/OR DISCOVERED BY: Luca Carettoni, Secure Network.
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200508-0254",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "santis 50",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": "4.2.8.0"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "santis wireless router",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "504.2.8.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "santis 50",
"version": "4.2.8.0"
}
],
"sources": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"db": "BID",
"id": "14372"
},
{
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:santis_50:4.2.8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-2424"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Luca Carettoni luca.carettoni@securenetwork.it",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
],
"trust": 0.6
},
"cve": "CVE-2005-2424",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "c62bae40-2355-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-13633",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2005-2424",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200508-018",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-13633",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-13633"
},
{
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink RTA300W, allows remote attackers to access the Telnet port without authentication via certain packets to the web interface that cause the interface to freeze. The Siemens Santis 50 wireless router is a wi-fi (802.11b) ADSL router for home and small business networks. \n\n\u00a0Siemens Santis 50 provides a web management interface and a classic telnet CLI for management purposes. These services are only available through the local network by default, but can also be activated through the WAN interface. Siemens Santis 50 Wireless router Web interface is affected by a remote denial of service vulnerability. The attacker can also erase the FLASH contents. \nInformation obtained may be used in further attacks against the vulnerable device or the network it operates on. \nThis issue may also affect the Ericsson HN294dp and Dynalink RTA300W routers. Both devices are believed to use the same hardware as the Siemens Santis 50 Wireless router; this has not been confirmed by Symantec. \n\n----------------------------------------------------------------------\n\nBist Du interessiert an einem neuen Job in IT-Sicherheit?\n\n\nSecunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-\nSicherheit:\nhttp://secunia.com/secunia_vacancies/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens Santis 50 Authentication Bypass Vulnerability\n\nSECUNIA ADVISORY ID:\nSA16215\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/16215/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nSecurity Bypass\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nSiemens Santis 50\nhttp://secunia.com/product/5440/\n\nDESCRIPTION:\nLuca Carettoni has reported a vulnerability in Siemens Santis 50,\nwhich can be exploited by malicious people to bypass certain security\nrestrictions. This can reportedly be exploited to\nview configuration information and potentially erase the device\u0027s\nflash memory. \n\nThe vulnerability has been reported in firmware version 4.2.8.0. \nOther versions may also be affected. \n\nSOLUTION:\nRestrict access to the device. \n\nPROVIDED AND/OR DISCOVERED BY:\nLuca Carettoni, Secure Network. \n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"db": "BID",
"id": "14372"
},
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-13633"
},
{
"db": "PACKETSTORM",
"id": "38873"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2005-2424",
"trust": 2.5
},
{
"db": "BID",
"id": "14372",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "16215",
"trust": 1.8
},
{
"db": "OSVDB",
"id": "18294",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200508-018",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2005-2595",
"trust": 0.8
},
{
"db": "XF",
"id": "50",
"trust": 0.6
},
{
"db": "XF",
"id": "21552",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20050725 SIEMENS SANTIS 50 AUTHENTICATION VULNERABILITY",
"trust": 0.6
},
{
"db": "IVD",
"id": "C62BAE40-2355-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-13633",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "38873",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"db": "VULHUB",
"id": "VHN-13633"
},
{
"db": "BID",
"id": "14372"
},
{
"db": "PACKETSTORM",
"id": "38873"
},
{
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
]
},
"id": "VAR-200508-0254",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"db": "VULHUB",
"id": "VHN-13633"
}
],
"trust": 0.09
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2005-2595"
}
]
},
"last_update_date": "2023-12-18T12:23:30.764000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-2424"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/14372"
},
{
"trust": 1.7,
"url": "http://www.securenetwork.it/advisories/"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/18294"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/16215"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/21552"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=112230914431638\u0026w=2"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/21552"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=112230914431638\u0026w=2"
},
{
"trust": 0.3,
"url": "http://www.siemens.ch/index.jsp?sdc_p=d1093191po1092631f64c175l1s2mn1092631t4u1260\u0026"
},
{
"trust": 0.3,
"url": "/archive/1/406379"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=112230914431638\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/16215/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5440/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-13633"
},
{
"db": "BID",
"id": "14372"
},
{
"db": "PACKETSTORM",
"id": "38873"
},
{
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"db": "VULHUB",
"id": "VHN-13633"
},
{
"db": "BID",
"id": "14372"
},
{
"db": "PACKETSTORM",
"id": "38873"
},
{
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-07-26T00:00:00",
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"date": "2005-07-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"date": "2005-08-03T00:00:00",
"db": "VULHUB",
"id": "VHN-13633"
},
{
"date": "2005-07-25T00:00:00",
"db": "BID",
"id": "14372"
},
{
"date": "2005-07-27T16:08:40",
"db": "PACKETSTORM",
"id": "38873"
},
{
"date": "2005-08-03T04:00:00",
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"date": "2005-07-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-07-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-13633"
},
{
"date": "2005-07-25T00:00:00",
"db": "BID",
"id": "14372"
},
{
"date": "2017-07-11T01:32:50.127000",
"db": "NVD",
"id": "CVE-2005-2424"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens Santis 50 Wireless Router Web Interface Denial of Service Vulnerability",
"sources": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2005-2595"
},
{
"db": "BID",
"id": "14372"
}
],
"trust": 1.1
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Access verification error",
"sources": [
{
"db": "IVD",
"id": "c62bae40-2355-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-200508-018"
}
],
"trust": 0.8
}
}
VAR-200203-0057
Vulnerability from variot - Updated: 2023-12-18 12:14Linksys EtherFast BEFN2PS4, BEFSR41, and BEFSR81 Routers, and possibly other products, allow remote attackers to gain sensitive information and cause a denial of service via an SNMP query for the default community string "public," which causes the router to change its configuration and send SNMP trap information back to the system that initiated the query. Linksys DSL router is a high-speed internet access solution provided by Linksys Group. Linksys DSL routers provide features including high-speed internet access, built-in switching capabilities in the router, and Voice-over-IP.
Linksys routers send SNMP traps to arbitrary addresses. This will leak network traffic information handled by the router. Because SNMP uses UDP as a means of transmitting information, this may result in a number of routers being used to create a network of distributed denial of service attacks. The problem is in the use of a default community string. The problem affects Linksys routers which may work with either Microsoft or Unix and Linux systems
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200203-0057",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "befsr41",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "0.0"
},
{
"model": "befn2ps4",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "0.0"
},
{
"model": "befsr81",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "*"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "etherfast befsr81 router",
"scope": null,
"trust": 0.6,
"vendor": "linksys",
"version": null
},
{
"model": "etherfast befn2ps4 router",
"scope": null,
"trust": 0.6,
"vendor": "linksys",
"version": null
},
{
"model": "befsr81",
"scope": null,
"trust": 0.6,
"vendor": "linksys",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0013"
},
{
"db": "BID",
"id": "3797"
},
{
"db": "BID",
"id": "3795"
},
{
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:befn2ps4:0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr41:0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr81:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0109"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "This vulnerability was announced by Matthew S. Hallacy \u003cpoptix@techmonkeys.org\u003e via Bugtraq on January 6, 2002.",
"sources": [
{
"db": "BID",
"id": "3797"
},
{
"db": "BID",
"id": "3795"
}
],
"trust": 0.6
},
"cve": "CVE-2002-0109",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-4504",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2002-0109",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200203-048",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-4504",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-4504"
},
{
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys EtherFast BEFN2PS4, BEFSR41, and BEFSR81 Routers, and possibly other products, allow remote attackers to gain sensitive information and cause a denial of service via an SNMP query for the default community string \"public,\" which causes the router to change its configuration and send SNMP trap information back to the system that initiated the query. Linksys DSL router is a high-speed internet access solution provided by Linksys Group. Linksys DSL routers provide features including high-speed internet access, built-in switching capabilities in the router, and Voice-over-IP. \n\n\u00a0Linksys routers send SNMP traps to arbitrary addresses. This will leak network traffic information handled by the router. Because SNMP uses UDP as a means of transmitting information, this may result in a number of routers being used to create a network of distributed denial of service attacks. The problem is in the use of a default community string. The problem affects Linksys routers which may work with either Microsoft or Unix and Linux systems",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"db": "CNVD",
"id": "CNVD-2002-0013"
},
{
"db": "BID",
"id": "3797"
},
{
"db": "BID",
"id": "3795"
},
{
"db": "VULHUB",
"id": "VHN-4504"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2002-0109",
"trust": 2.9
},
{
"db": "BID",
"id": "3795",
"trust": 2.0
},
{
"db": "BID",
"id": "3797",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200203-048",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2002-0013",
"trust": 0.6
},
{
"db": "XF",
"id": "7827",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20020106 LINKSYS \u0027ROUTERS\u0027, SNMP ISSUES",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-4504",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0013"
},
{
"db": "VULHUB",
"id": "VHN-4504"
},
{
"db": "BID",
"id": "3797"
},
{
"db": "BID",
"id": "3795"
},
{
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
]
},
"id": "VAR-200203-0057",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-4504"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:14:07.449000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0109"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/3795"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/3797"
},
{
"trust": 1.7,
"url": "http://www.iss.net/security_center/static/7827.php"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=101039288111680\u0026w=2"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=101039288111680\u0026w=2"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=101039288111680\u0026amp;w=2"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-4504"
},
{
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2002-0013"
},
{
"db": "VULHUB",
"id": "VHN-4504"
},
{
"db": "BID",
"id": "3797"
},
{
"db": "BID",
"id": "3795"
},
{
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-01-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-0013"
},
{
"date": "2002-03-25T00:00:00",
"db": "VULHUB",
"id": "VHN-4504"
},
{
"date": "2002-01-06T00:00:00",
"db": "BID",
"id": "3797"
},
{
"date": "2002-01-06T00:00:00",
"db": "BID",
"id": "3795"
},
{
"date": "2002-03-25T05:00:00",
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"date": "2002-01-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-01-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-0013"
},
{
"date": "2016-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-4504"
},
{
"date": "2009-07-11T09:56:00",
"db": "BID",
"id": "3797"
},
{
"date": "2009-07-11T09:56:00",
"db": "BID",
"id": "3795"
},
{
"date": "2016-10-18T02:16:15.937000",
"db": "NVD",
"id": "CVE-2002-0109"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "3797"
},
{
"db": "BID",
"id": "3795"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys DSL Router Arbitrarily Sets SNMP Trap System Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-0013"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "3797"
},
{
"db": "BID",
"id": "3795"
},
{
"db": "CNNVD",
"id": "CNNVD-200203-048"
}
],
"trust": 1.2
}
}
VAR-200211-0010
Vulnerability from variot - Updated: 2023-12-18 12:13The remote management web server for Linksys BEFSR41 EtherFast Cable/DSL Router before firmware 1.42.7 allows remote attackers to cause a denial of service (crash) via an HTTP request to Gozila.cgi without any arguments. Linksys EtherFast Cable / DSL routers is a small four-port router designed to optimize the use of DSL or Cable connections.
BEFSR41 contains a WEB interface that can be used to manage the configuration, which includes the Gozila.cgi script, but if the Gozila.cgi script is requested without submitting any parameters, it can cause BEFSR41 to crash and stop responding to normal requests. Linksys BEFSR41 is vulnerable to a denial of service condition. The denial of service condition will be triggered when the device receives a request for the script file 'Gozila.cgi' without any parameters
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200211-0010",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "befsr41",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.40.2"
},
{
"model": "befsr41",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.42.7"
},
{
"model": "befsr41",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.41"
},
{
"model": "befsr41",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.42.3"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "etherfast befsr41 router",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.42.7"
},
{
"model": "etherfast befsr41 router",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.42.3"
},
{
"model": "etherfast befsr41 router",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.41"
},
{
"model": "etherfast befsr41 router",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.40.2"
},
{
"model": "etherfast befsr41 router",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "1.43"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-3969"
},
{
"db": "BID",
"id": "6086"
},
{
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr41:1.40.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr41:1.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr41:1.42.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr41:1.42.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-1236"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jeep 94\u203b lowjeep94@hotmail.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
],
"trust": 0.6
},
"cve": "CVE-2002-1236",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-5621",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2002-1236",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200211-014",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-5621",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-5621"
},
{
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The remote management web server for Linksys BEFSR41 EtherFast Cable/DSL Router before firmware 1.42.7 allows remote attackers to cause a denial of service (crash) via an HTTP request to Gozila.cgi without any arguments. Linksys EtherFast Cable / DSL routers is a small four-port router designed to optimize the use of DSL or Cable connections. \n\n\u00a0BEFSR41 contains a WEB interface that can be used to manage the configuration, which includes the Gozila.cgi script, but if the Gozila.cgi script is requested without submitting any parameters, it can cause BEFSR41 to crash and stop responding to normal requests. Linksys BEFSR41 is vulnerable to a denial of service condition. \nThe denial of service condition will be triggered when the device receives a request for the script file \u0027Gozila.cgi\u0027 without any parameters",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"db": "CNVD",
"id": "CNVD-2002-3969"
},
{
"db": "BID",
"id": "6086"
},
{
"db": "VULHUB",
"id": "VHN-5621"
}
],
"trust": 1.8
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-5621",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-5621"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2002-1236",
"trust": 2.6
},
{
"db": "BID",
"id": "6086",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-200211-014",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2002-3969",
"trust": 0.6
},
{
"db": "VULNWATCH",
"id": "20021101 IDEFENSE SECURITY ADVISORY 10.31.02A: DENIAL OF SERVICE VULNERABILITY IN LINKSYS BEFSR41 ETHERFAST CABLE/DSL ROUTER",
"trust": 0.6
},
{
"db": "XF",
"id": "10514",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20021101 IDEFENSE SECURITY ADVISORY 10.31.02A: DENIAL OF SERVICE VULNERABILITY IN LINKSYS BEFSR41 ETHERFAST CABLE/DSL ROUTER",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "21975",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-5621",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-3969"
},
{
"db": "VULHUB",
"id": "VHN-5621"
},
{
"db": "BID",
"id": "6086"
},
{
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
]
},
"id": "VAR-200211-0010",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-5621"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:13:59.558000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-1236"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/6086"
},
{
"trust": 1.7,
"url": "http://www.idefense.com/advisory/10.31.02a.txt"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0049.html"
},
{
"trust": 1.7,
"url": "http://www.iss.net/security_center/static/10514.php"
},
{
"trust": 1.1,
"url": "http://marc.info/?l=bugtraq\u0026m=103616324103171\u0026w=2"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103616324103171\u0026w=2"
},
{
"trust": 0.3,
"url": "http://www.linksys.com/products/group.asp?grid=23"
},
{
"trust": 0.3,
"url": "/archive/1/298188"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-5621"
},
{
"db": "BID",
"id": "6086"
},
{
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2002-3969"
},
{
"db": "VULHUB",
"id": "VHN-5621"
},
{
"db": "BID",
"id": "6086"
},
{
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-10-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-3969"
},
{
"date": "2002-11-12T00:00:00",
"db": "VULHUB",
"id": "VHN-5621"
},
{
"date": "2002-11-01T00:00:00",
"db": "BID",
"id": "6086"
},
{
"date": "2002-11-12T05:00:00",
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"date": "2002-10-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-10-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2002-3969"
},
{
"date": "2016-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-5621"
},
{
"date": "2009-07-11T18:06:00",
"db": "BID",
"id": "6086"
},
{
"date": "2016-10-18T02:25:06.133000",
"db": "NVD",
"id": "CVE-2002-1236"
},
{
"date": "2005-05-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys BEFSR41 EtherFast Cable / DSL Router Remote Denial of Service Attack Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2002-3969"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200211-014"
}
],
"trust": 0.6
}
}
VAR-200412-0788
Vulnerability from variot - Updated: 2023-12-18 12:13The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt to login to an administration web page, even when the configuration specifies that remote administration is disabled. Linksys WRT54G Router is a router device.
Even when the management function is turned off, Linksys WRT54G Router still provides 80 and 443 port management web pages on the WAN interface. As a result, an attacker can access the management interface. In combination with other loopholes, the router may be controlled. A weakness is reported to affect the Linksys WRT54G appliance
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200412-0788",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wrt54g",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "2.02.7"
},
{
"model": "befsr41 v3",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "*"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "befsr41 v3",
"scope": null,
"trust": 0.6,
"vendor": "linksys",
"version": null
},
{
"model": "samadhi2 .6sv",
"scope": "eq",
"trust": 0.3,
"vendor": "sveasoft",
"version": "2.0.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "wpc300n wireless-n notebook adapter",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "-4.100.15.5"
},
{
"model": "wrt54g beta",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1560"
},
{
"db": "BID",
"id": "10441"
},
{
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:befsr41_v3:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54g:2.02.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-2606"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alan W. Rateliff, II\u203b lists@rateliff.net",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
],
"trust": 0.6
},
"cve": "CVE-2004-2606",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-11034",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2004-2606",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200412-618",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-11034",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-11034"
},
{
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt to login to an administration web page, even when the configuration specifies that remote administration is disabled. Linksys WRT54G Router is a router device. \n\n\u00a0Even when the management function is turned off, Linksys WRT54G Router still provides 80 and 443 port management web pages on the WAN interface. As a result, an attacker can access the management interface. In combination with other loopholes, the router may be controlled. A weakness is reported to affect the Linksys WRT54G appliance",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"db": "CNVD",
"id": "CNVD-2004-1560"
},
{
"db": "BID",
"id": "10441"
},
{
"db": "VULHUB",
"id": "VHN-11034"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2004-2606",
"trust": 2.3
},
{
"db": "BID",
"id": "10441",
"trust": 2.0
},
{
"db": "OSVDB",
"id": "6577",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "11754",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2004-1560",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040604 THE LINKSYS WRT54G \"SECURITY PROBLEM\" DOESN\u0027T EXIST",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040604 RE: THE LINKSYS WRT54G \"SECURITY PROBLEM\" DOESN\u0027T EXIST",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040601 RE: LINKSYS WRT54G ADMINISTRATION PAGE AVAILBLE TO WAN",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040602 RE: THE LINKSYS WRT54G \"SECURITY PROBLEM\" DOESN\u0027T EXIST",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040602 ADDITIONAL INFORMATION ON WRT54G ADMINISTRATION PAGE",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040531 LINKSYS WRT54G ADMINISTRATION PAGE AVAILBLE TO WAN",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "6513",
"trust": 0.6
},
{
"db": "XF",
"id": "16274",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-11034",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1560"
},
{
"db": "VULHUB",
"id": "VHN-11034"
},
{
"db": "BID",
"id": "10441"
},
{
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
]
},
"id": "VAR-200412-0788",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-11034"
}
],
"trust": 0.6353147
},
"last_update_date": "2023-12-18T12:13:40.262000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-2606"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/10441"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-05/0316.html"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0002.html"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0020.html"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0190.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/365227/30/0/threaded"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/365175"
},
{
"trust": 1.7,
"url": "ftp://ftp.linksys.com/pub/network/wrt54g_2.02.8_us_code_beta.zip"
},
{
"trust": 1.7,
"url": "http://web.archive.org/web/20040823075750/http://www.linksys.com/download/firmware.asp?fwid=201"
},
{
"trust": 1.7,
"url": "http://www.nwfusion.com/news/2004/0607confuse.html"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/6577"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/11754"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16274"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/16274"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/6513"
},
{
"trust": 0.3,
"url": "http://www.linksys.com/download/firmware.asp?fwid=201"
},
{
"trust": 0.3,
"url": "http://www.sveasoft.com/modules/phpbb2/index.php"
},
{
"trust": 0.3,
"url": "http://www.linksys.com/products/product.asp?prid=508\u0026scid=35"
},
{
"trust": 0.3,
"url": "/archive/1/364977"
},
{
"trust": 0.3,
"url": "/archive/1/364729"
},
{
"trust": 0.3,
"url": "/archive/1/365175"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-11034"
},
{
"db": "BID",
"id": "10441"
},
{
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2004-1560"
},
{
"db": "VULHUB",
"id": "VHN-11034"
},
{
"db": "BID",
"id": "10441"
},
{
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-05-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-1560"
},
{
"date": "2004-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-11034"
},
{
"date": "2004-05-31T00:00:00",
"db": "BID",
"id": "10441"
},
{
"date": "2004-12-31T05:00:00",
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"date": "2004-05-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-05-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-1560"
},
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-11034"
},
{
"date": "2004-05-31T00:00:00",
"db": "BID",
"id": "10441"
},
{
"date": "2017-07-11T01:32:03",
"db": "NVD",
"id": "CVE-2004-2606"
},
{
"date": "2006-01-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys WRT54G Router Global Access Management Service Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1560"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "10441"
},
{
"db": "CNNVD",
"id": "CNNVD-200412-618"
}
],
"trust": 0.9
}
}
VAR-200703-0565
Vulnerability from variot - Updated: 2023-12-18 12:12Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which triggers memory corruption. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. D-Link TFTP Server is a TFTP service program built into D-Link wireless AP. D-Link TFTP Server has a vulnerability in processing malformed TFTP access requests, and remote attackers may use this vulnerability to control the server. Test code: http://www.securityfocus.com/data/vulnerabilities/exploits/22923.rb Patching plan: The vendor has not released upgrade patches for the time being, please pay attention to the vendor address in time: http://www.dlink.com. D-Link TFTP is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before storing it in a finite-sized buffer. Given the nature of this issue, the attacker may presumably be able to execute code. D-Link TFTP 1.0 is vulnerable; other versions may also be affected.
Want a new job? http://secunia.com/secunia_vacancies/
Secunia is looking for new researchers with a reversing background and experience in writing exploit code: http://secunia.com/hardcore_disassembler_and_reverse_engineer/ http://secunia.com/Disassembling_og_Reversing/
TITLE: D-Link TFTP Server Data Handling Memory Corruption
SECUNIA ADVISORY ID: SA24360
VERIFY ADVISORY: http://secunia.com/advisories/24360/
CRITICAL: Moderately critical
IMPACT: System access
WHERE:
From local network
SOFTWARE: D-Link TFTP Server 1.x http://secunia.com/product/13596/
DESCRIPTION: Parvez Anwar has discovered a vulnerability in D-Link TFTP Server, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to an error within the handling of received data. This can be exploited to corrupt certain structures in memory via an overly long (greater than 300 bytes), specially crafted GET or PUT request.
The vulnerability is confirmed in version 1.0.
SOLUTION: Use in a trusted network environment only.
PROVIDED AND/OR DISCOVERED BY: Parvez Anwar
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200703-0565",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tftp server",
"scope": "eq",
"trust": 2.7,
"vendor": "d link",
"version": "1.0"
},
{
"model": null,
"scope": null,
"trust": 1.2,
"vendor": "none",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"db": "BID",
"id": "22923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:d-link:tftp_server:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1435"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Parvez Anwar",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
],
"trust": 0.6
},
"cve": "CVE-2007-1435",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2007-1435",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-24797",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-1435",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200703-350",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-24797",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24797"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which triggers memory corruption. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. D-Link TFTP Server is a TFTP service program built into D-Link wireless AP. D-Link TFTP Server has a vulnerability in processing malformed TFTP access requests, and remote attackers may use this vulnerability to control the server. Test code: http://www.securityfocus.com/data/vulnerabilities/exploits/22923.rb Patching plan: The vendor has not released upgrade patches for the time being, please pay attention to the vendor address in time: http://www.dlink.com. D-Link TFTP is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before storing it in a finite-sized buffer. Given the nature of this issue, the attacker may presumably be able to execute code. \nD-Link TFTP 1.0 is vulnerable; other versions may also be affected. \n\n----------------------------------------------------------------------\n\nWant a new job?\nhttp://secunia.com/secunia_vacancies/\n\nSecunia is looking for new researchers with a reversing background\nand experience in writing exploit code:\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\nhttp://secunia.com/Disassembling_og_Reversing/\n\n----------------------------------------------------------------------\n\nTITLE:\nD-Link TFTP Server Data Handling Memory Corruption\n\nSECUNIA ADVISORY ID:\nSA24360\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/24360/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nSystem access\n\nWHERE:\n\u003eFrom local network\n\nSOFTWARE:\nD-Link TFTP Server 1.x\nhttp://secunia.com/product/13596/\n\nDESCRIPTION:\nParvez Anwar has discovered a vulnerability in D-Link TFTP Server,\nwhich can be exploited by malicious people to compromise a vulnerable\nsystem. \n\nThe vulnerability is caused due to an error within the handling of\nreceived data. This can be exploited to corrupt certain structures in\nmemory via an overly long (greater than 300 bytes), specially crafted\nGET or PUT request. \n\nThe vulnerability is confirmed in version 1.0. \n\nSOLUTION:\nUse in a trusted network environment only. \n\nPROVIDED AND/OR DISCOVERED BY:\nParvez Anwar\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"db": "BID",
"id": "22923"
},
{
"db": "VULHUB",
"id": "VHN-24797"
},
{
"db": "PACKETSTORM",
"id": "54996"
}
],
"trust": 3.15
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-24797",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24797"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-1435",
"trust": 3.4
},
{
"db": "BID",
"id": "22923",
"trust": 2.6
},
{
"db": "SECUNIA",
"id": "24360",
"trust": 2.4
},
{
"db": "OSVDB",
"id": "33977",
"trust": 2.3
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001692",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2007-1848",
"trust": 0.6
},
{
"db": "CNCVE",
"id": "CNCVE-20071435",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2007-1847",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200703-350",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "29735",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "16345",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-83218",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-70862",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "83123",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-24797",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "54996",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"db": "VULHUB",
"id": "VHN-24797"
},
{
"db": "BID",
"id": "22923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"db": "PACKETSTORM",
"id": "54996"
},
{
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
]
},
"id": "VAR-200703-0565",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"db": "VULHUB",
"id": "VHN-24797"
}
],
"trust": 0.13
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 1.2
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"db": "CNVD",
"id": "CNVD-2007-1847"
}
]
},
"last_update_date": "2023-12-18T12:12:44.158000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.dlink.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1435"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://osvdb.org/33977"
},
{
"trust": 2.3,
"url": "http://secunia.com/advisories/24360"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/22923"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1435"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1435"
},
{
"trust": 0.3,
"url": "http://www.dlink.com.sg/products/?pid=308"
},
{
"trust": 0.3,
"url": "http://www.d-link.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/24360/"
},
{
"trust": 0.1,
"url": "http://secunia.com/disassembling_og_reversing/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13596/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"db": "VULHUB",
"id": "VHN-24797"
},
{
"db": "BID",
"id": "22923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"db": "PACKETSTORM",
"id": "54996"
},
{
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"db": "VULHUB",
"id": "VHN-24797"
},
{
"db": "BID",
"id": "22923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"db": "PACKETSTORM",
"id": "54996"
},
{
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"date": "2007-03-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"date": "2007-03-13T00:00:00",
"db": "VULHUB",
"id": "VHN-24797"
},
{
"date": "2007-03-12T00:00:00",
"db": "BID",
"id": "22923"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"date": "2007-03-13T00:30:19",
"db": "PACKETSTORM",
"id": "54996"
},
{
"date": "2007-03-13T19:19:00",
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"date": "2007-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-1848"
},
{
"date": "2007-03-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-1847"
},
{
"date": "2008-11-13T00:00:00",
"db": "VULHUB",
"id": "VHN-24797"
},
{
"date": "2015-05-12T19:29:00",
"db": "BID",
"id": "22923"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001692"
},
{
"date": "2008-11-13T06:34:55.740000",
"db": "NVD",
"id": "CVE-2007-1435"
},
{
"date": "2007-03-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link TFTP Server Vulnerable to buffer overflow",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001692"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-350"
}
],
"trust": 0.6
}
}
VAR-200809-0058
Vulnerability from variot - Updated: 2023-12-18 12:12The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters. D-Link DIR-100 is a small broadband router with integrated firewall function.
There are loopholes in the implementation of DIR-100's web management interface. If users use a long URL of about 1300 characters in a web browser, they can bypass URL filtering performed by the built-in firewall of D-Link DIR-100 router. Access to restricted resources. D-Link DIR-100 is affected by a vulnerability that allows attackers to bypass security restrictions and access sites that are blocked by an administrator. D-Link DIR-100 devices with firmware 1.12 are vulnerable; other versions may be affected as well. ----------------------------------------------------------------------
We have updated our website, enjoy! http://secunia.com/
TITLE: D-Link DIR-100 Ethernet Broadband Router URL Filtering Bypass
SECUNIA ADVISORY ID: SA31767
VERIFY ADVISORY: http://secunia.com/advisories/31767/
CRITICAL: Less critical
IMPACT: Security Bypass
WHERE:
From local network
OPERATING SYSTEM: D-Link DIR-100 Ethernet Broadband Router http://secunia.com/product/19762/
DESCRIPTION: Marc Ruef has reported a vulnerability in D-Link DIR-100 Ethernet Broadband Router, which can be exploited by malicious people to bypass the URL filtering functionality.
The vulnerability is caused due to an error within the parental control when handling certain requested URLs and can be exploited to access forbidden websites via long, specially crafted requests.
SOLUTION: Do not rely on the filtering mechanism.
PROVIDED AND/OR DISCOVERED BY: Marc Ruef, scip AG
ORIGINAL ADVISORY: http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064303.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200809-0058",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dir-100",
"scope": "eq",
"trust": 1.9,
"vendor": "d link",
"version": "1.12"
},
{
"model": "dir-100",
"scope": "eq",
"trust": 1.6,
"vendor": "d link",
"version": "1.02"
},
{
"model": "dir-100",
"scope": "lte",
"trust": 0.8,
"vendor": "d link",
"version": "firmware 1.12"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2008-4325"
},
{
"db": "BID",
"id": "31050"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dir-100:1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:d-link:dir-100:1.02:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-4133"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Marc Ruef",
"sources": [
{
"db": "BID",
"id": "31050"
}
],
"trust": 0.3
},
"cve": "CVE-2008-4133",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2008-4133",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-34258",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-4133",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200809-264",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-34258",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34258"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters. D-Link DIR-100 is a small broadband router with integrated firewall function. \n\n\u00a0There are loopholes in the implementation of DIR-100\u0027s web management interface. If users use a long URL of about 1300 characters in a web browser, they can bypass URL filtering performed by the built-in firewall of D-Link DIR-100 router. Access to restricted resources. D-Link DIR-100 is affected by a vulnerability that allows attackers to bypass security restrictions and access sites that are blocked by an administrator. \nD-Link DIR-100 devices with firmware 1.12 are vulnerable; other versions may be affected as well. ----------------------------------------------------------------------\n\nWe have updated our website, enjoy!\nhttp://secunia.com/\n\n----------------------------------------------------------------------\n\nTITLE:\nD-Link DIR-100 Ethernet Broadband Router URL Filtering Bypass\n\nSECUNIA ADVISORY ID:\nSA31767\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/31767/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nSecurity Bypass\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nD-Link DIR-100 Ethernet Broadband Router\nhttp://secunia.com/product/19762/\n\nDESCRIPTION:\nMarc Ruef has reported a vulnerability in D-Link DIR-100 Ethernet\nBroadband Router, which can be exploited by malicious people to\nbypass the URL filtering functionality. \n\nThe vulnerability is caused due to an error within the parental\ncontrol when handling certain requested URLs and can be exploited to\naccess forbidden websites via long, specially crafted requests. \n\nSOLUTION:\nDo not rely on the filtering mechanism. \n\nPROVIDED AND/OR DISCOVERED BY:\nMarc Ruef, scip AG\n\nORIGINAL ADVISORY:\nhttp://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064303.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"db": "CNVD",
"id": "CNVD-2008-4325"
},
{
"db": "BID",
"id": "31050"
},
{
"db": "VULHUB",
"id": "VHN-34258"
},
{
"db": "PACKETSTORM",
"id": "69757"
}
],
"trust": 2.61
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-34258",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34258"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-4133",
"trust": 3.4
},
{
"db": "BID",
"id": "31050",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "31767",
"trust": 1.8
},
{
"db": "SREASON",
"id": "4276",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1020825",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2008-4325",
"trust": 0.6
},
{
"db": "XF",
"id": "100",
"trust": 0.6
},
{
"db": "XF",
"id": "44961",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20080908 [SCIP_ADVISORY 3808] D-LINK DIR-100 LONG URL FILTER EVASION",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080908 [SCIP_ADVISORY 3808] D-LINK DIR-100 LONG URL FILTER EVASION",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200809-264",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "32336",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-85630",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-34258",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "69757",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2008-4325"
},
{
"db": "VULHUB",
"id": "VHN-34258"
},
{
"db": "BID",
"id": "31050"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"db": "PACKETSTORM",
"id": "69757"
},
{
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
]
},
"id": "VAR-200809-0058",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2008-4325"
},
{
"db": "VULHUB",
"id": "VHN-34258"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2008-4325"
}
]
},
"last_update_date": "2023-12-18T12:12:32.083000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.dlink.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34258"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"db": "NVD",
"id": "CVE-2008-4133"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/31050"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0133.html"
},
{
"trust": 1.7,
"url": "http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3808"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1020825"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/31767"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/4276"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/496072/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44961"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-4133"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-4133"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/44961"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/496072/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://www.dlink.co.uk/?go=jn7uaylx/oijawvudlyzu93ygjvykujxstvhlpg3yv3ov41/haltbnlwaarp7touamu5j3cf/yenbs7l1kfnl0sstuzf"
},
{
"trust": 0.3,
"url": "/archive/1/496072"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31767/"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2008-september/064303.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19762/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34258"
},
{
"db": "BID",
"id": "31050"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"db": "PACKETSTORM",
"id": "69757"
},
{
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2008-4325"
},
{
"db": "VULHUB",
"id": "VHN-34258"
},
{
"db": "BID",
"id": "31050"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"db": "PACKETSTORM",
"id": "69757"
},
{
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-09-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-4325"
},
{
"date": "2008-09-19T00:00:00",
"db": "VULHUB",
"id": "VHN-34258"
},
{
"date": "2008-09-08T00:00:00",
"db": "BID",
"id": "31050"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"date": "2008-09-09T20:50:53",
"db": "PACKETSTORM",
"id": "69757"
},
{
"date": "2008-09-19T17:15:05.593000",
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"date": "2008-09-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-09-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-4325"
},
{
"date": "2018-10-11T00:00:00",
"db": "VULHUB",
"id": "VHN-34258"
},
{
"date": "2015-04-16T17:54:00",
"db": "BID",
"id": "31050"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-003444"
},
{
"date": "2018-10-11T20:51:01.567000",
"db": "NVD",
"id": "CVE-2008-4133"
},
{
"date": "2009-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "D-Link DIR-100 upper Web In proxy service Web Vulnerability bypassing restriction filters",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-003444"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-264"
}
],
"trust": 0.6
}
}
VAR-200806-0031
Vulnerability from variot - Updated: 2023-12-18 12:12Stack-based buffer overflow in the ODBC server service in Citect CitectSCADA 6 and 7, and CitectFacilities 7, allows remote attackers to execute arbitrary code via a long string in the second application packet in a TCP session on port 20222. Citect Made by company CitectSCADA Contains a buffer overflow vulnerability. Citect CitectSCADA Is SCADA (Supervisory Control And Data Acquisition) Software used for monitoring and control in the system. CitectSCADA Contains a buffer overflow vulnerability because it cannot properly handle crafted requests from clients.Arbitrary code is executed by a remote party or service operation is interrupted (DoS) There is a possibility of being attacked.
Citect SCADA and CitectFacilities include ODBC server functionality to provide remote SQL access to relational databases. The ODBC server component listens to client requests from the network on the port 20222 / tcp by default. The application layer protocol on TCP reads the 4-byte initial message to specify the length of the data in the next message, and then sockets from the same TCP. Word reads the next message of this length, where the first 5 bytes are a fixed header. After the second message in the network is read into the buffer, the data is copied to a fixed-size internal buffer on the stack.
Due to the lack of a correct length check of the data read, memory copy operations using fixed-size target buffers allocated on the stack may overflow, allowing unauthenticated remote attackers to execute arbitrary instructions on the vulnerable system . CitectSCADA is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks will likely cause denial-of-service conditions. ----------------------------------------------------------------------
Want a new job?
http://secunia.com/secunia_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/
International Partner Manager - Project Sales in the IT-Security Industry: http://corporate.secunia.com/about_secunia/64/
TITLE: Citect Products ODBC Server Component Buffer Overflow
SECUNIA ADVISORY ID: SA30638
VERIFY ADVISORY: http://secunia.com/advisories/30638/
CRITICAL: Moderately critical
IMPACT: DoS, System access
WHERE:
From local network
SOFTWARE: CitectFacilities 7.x http://secunia.com/product/19043/ CitectSCADA 6.x http://secunia.com/product/19041/ CitectSCADA 7.x http://secunia.com/product/19042/
DESCRIPTION: Core Security Technologies has reported a vulnerability in CitectSCADA and CitectFacilities, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.
The vulnerability is reported in the following versions: * CitectSCADA v6 * CitectSCADA v7 * CitectFacilities v7
SOLUTION: Contact the vendor for patches.
PROVIDED AND/OR DISCOVERED BY: Sebasti\xe1n Mu\xf1iz, Core Security Technologies
ORIGINAL ADVISORY: CORE-2008-0125: http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=2186
OTHER REFERENCES: US-CERT VU#476345: http://www.kb.cert.org/vuls/id/476345
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
~ Core Security Technologies - CoreLabs Advisory ~ http://www.coresecurity.com/corelabs/
~ CitectSCADA ODBC service vulnerability
Advisory Information
Title: CitectSCADA ODBC service vulnerability Advisory ID: CORE-2008-0125 Advisory URL: http://www.coresecurity.com/?action=item&id=2186 Date published: 2008-06-11 Date of last update: 2008-06-10 Vendors contacted: Citect Release mode: Coordinated release
Vulnerability Information
Class: Buffer overflow
Remotely Exploitable: Yes
Locally Exploitable: Yes
Bugtraq ID: 29634
CVE Name: CVE-2008-2639
Vulnerability Description
Citect is a supplier of industrial automation software with headquarters in Australia and over 20 offices in Oceania, South East Asia, China, Japan, the Americas, Europe, Africa and the Middle East. Citect's products are distributed in over 80 countries through a network of more than 500 partners. According to Citect's website [1] the company, a fully owned subsidiary of Schneider Electric, has more than 150,000 licenses of its software sold to date. Citect's products are used by organizations worldwide in numerous industries including Aerospace & Defense, Oil & Gas, Power/Utilities, Chemical, Pharmaceutical, Manufacturing and others. with an integrated Human Machine Interface (HMI) / SCADA solution to deliver a scalable and reliable control and monitoring system. The system is composed by software installed on standard computer equipment running on commercial-of-the-shelf Microsoft Windows operating systems. To accomplish such goal the would-be attacker must be able to connect to the vulnerable service on a TCP high-port.
Vulnerable Packages
. CitectSCADA v6 . CitectSCADA v7 . CitectFacilities v7
Non-vulnerable Packages
. Contact the vendor for fixed versions of the product.
Vendor Information, Solutions and Workarounds
In general process control networks should be physically isolated from corporate or other publicly accessible data networks as such an isolated network will limit the exposure of systems with network facing vulnerabilities only to accidental disruption or potentially malicious users or systems within the process control network itself.
However, if physical isolation of the process control network is not feasible it is strongly recommended to enforce and monitor strict network access control mechanisms to verify that only the absolute minimal required set of systems from both within and outside the process control network are allowed to connect to any systems within the process control network. In this particular case, access control mechanisms on both end-systems and network boundary devices such as firewalls and IPSes must ensure that only hardened and trusted systems from that minimal set can connect to systems in the process control network running potentially vulnerable software. Nonetheless systems on that minimal set must still be considered potential attack vectors into the process control network and should they become compromised, providers of transitive trust from the process control network to external untrusted systems.
Besides the recommendation of a secure network architecture with strict network access control measures, OS hardening and other sound system administration practices a specific workaround for the vulnerability reported in this advisory is provided below.
The vulnerability is located in the ODBC server service, vulnerable organizations that do not require ODBC connectivity may disable the service with no adverse effects to the CitectSCADA software. Installations that require ODBC connectivity to SQL databases, spreadsheets, etc. will suffer loss of connection with ODBC data sources if this workaround is applied. Vulnerable organizations should obtain positive verification that ODBC connectivity is not necessary in their installation and prepare appropriate contingency procedures before the workaround is applied.
Vendor statement:
CitectSCADA is not designed to be accessible on public networks and recommends that the SCADA and control networks be protected by firewall or similar on live sites.
The system must be network hardened regardless of the corrupt packet software change to ensure a secure system given the likelihood that on the same network are open industry standard protocol devices perhaps communicating via ethernet.
Please follow this link on Citect website under "Industries and Solutions" for security, that provides some information for customers interested in securing their SCADA systems: http://www.citect.com/index.php?option=com_content&task=view&id=186&Itemid=322
Credits
This vulnerability was discovered and researched by Sebastian Mu\xf1iz from the Core IMPACT Exploit Writers Team (EWT) at Core Security Technologies. Exploitation was further investigated by Nicolas Economou also from the Core IMPACT Exploit Writers Team (EWT).
Core would also like to thank Paul Fahey of AusCERT, Gaston Franco and Patricia Prandini of ArCERT and Art Manion and Chris Taschner of CERT/CC for their assistance during the vulnerability reporting process.
This bug is a textbook example of a classic stack-based buffer overflow that can be exploited by overwriting the return address of the currently running thread. The following binary excerpt shows the nature of the problem:
/-----------
~ .text:0051BC33 loc_51BC33: ~ .text:0051BC33 lea ecx, [ebp+pDestBuffer] ~ .text:0051BC39 push ecx ; stack based buffer ~ .text:0051BC3A mov edx, [ebp+arg_0] ~ .text:0051BC3D push edx ; class that contains packet ~ .text:0051BC3E call sub_52125A ; memcpy
- -----------/
Report Timeline
. 2008-01-30: Initial contact mail sent by Core to Citect's support team. 2008-01-30: Additional mail sent to Citect support team asking for a software security contact at Citect. 2008-01-30: Email from Citect's support team acknowledging notification and requesting information in plaintext. 2008-02-06: Core sends the draft advisory, including proof of concept code to demonstrate the vulnerability. 2008-02-28: Core requests a response from the vendor and asks for the vendor's plan to release fixes to vulnerable products. 2008-03-06: Email from the vendor's technical architect confirms reception of the report and indicating that there are not concerns around publication of a security advisory disclosing the vulnerability. The vendor asks for a phone conference to ensure that both Core and Citect have a common understanding of the issue and expresses the possibility of adding additional information to the advisory. The vendor also states that it will formulate a plan for handling this issue. 2008-03-12: Core asks to continue the discussion concerning the vulnerability by mail so as to have all the involved parties informed simultaneously and all communications documented. Core requests confirmation that the vendor has been able to reproduce the vulnerability and requests details concerning the plan to release fixes and asks for the additional information that the vendor would like to include in the advisory (in the "vendor information" section). Core reminds the vendor that the original publication date of the advisory was February 25th and states that the publication of the advisory is now re-scheduled to March 24th because fixed versions were not available at the date initially scheduled. 2008-03-25: Vendor confirms that it reproduced and identified the vulnerability and indicates that the official stance is that CitectSCADA is not designed to be accessible on public networks and recommends that SCADA and control networks are protected by firewalls and other security measures on live sites. The vendor also states that it has no immediate plans to support CitectSCADA on public networks but is investigating the possibility of having a security audit of the product. 2008-03-25: Core notifies the vendor the intention to release the advisory on March 26th given that the vendor has no immediate plans for fixing the vulnerability. 2008-03-26: Core consults under NDA with a process control security expert to obtain a better understanding of the scope and impact of the vulnerability. The specific technical details about the vulnerability are not disclosed, only the general type of bug and the specific TCP port on which the vulnerable service listens are discussed. 2008-04-02: Core revisits its current plan to disclose the vulnerability and decides to get Computer Emergency Response Teams (CERTs) involved in the process. Core notifies the vendor that it will postpone the publication of the advisory, and that it will contact the Computer Emergency Response Teams (CERTs) of countries were Core has physical offices (Argentina and USA) and the country were Citect has its headquarters (Australia). Core will then determine the contents and date of publication for the security advisory based on further communication with the vendor and CERTs and more precise details that the vendor may provide regarding availability of fixes. 2008-04-02: Core notifies the vendor that it will contact the CERTs of Australia, USA and Argentina. Core reminds the vendor that the vulnerability reported is a classic example of a stack-based buffer overflow bug trivial to exploit in present times and that although the previous email from the vendor provided a vague statement indicating that "the scenario is under consideration for the next release", to date there has not been any concrete details about development and release of fixes or a firm commitment to any specific date to release them. 2008-04-08: Core sends an initial notification to AusCERT, CERT/CC and ArCert including a draft advisory describing the bug and the vendor's contact information, requesting an acknowledgement within 2 working days. 2008-04-08: AusCERT acknowledges reception of the advisory
. 2008-04-09: ArCERT acknowledges reception of the advisory
. 2008-04-10: CERT/CC acknowledges reception of the advisory on a phone call
. 2008-04-10: AusCERT notifies Core that so far it has not been able to contact the vendor and asks for approval to disseminate the information to the Australian government and other national and international entities overlooking national infrastructure security. AusCERT also asks if CORE intends to publish the advisory and if so requests some time to be able to notify affected organizations. Meanwhile AusCERT indicates that it will continue to try to work with the vendor. 2008-04-10: Core responds that it has no problems with AusCERT notifying other parties that may be able to better prepare risk mitigation procedures and/or work more closely with the vendor towards development and release of a fix. However, Core asks to keep the dissemination of the information to a minimum in order to avoid a potential leak. Core indicates that it has asked the vendor to provide concrete details about how and when it plans to address the issue and that based on the response to that question it will determine a publication date for the security advisory. Lacking a response from the vendor, Core will determine the publication date based on the feedback received from the CERTs and the progress of their preparations to address the report. 2008-04-10: AusCERT asks if it is ok to contact other CERTs and international government communities to make them aware of the issue and to ensure everyone is prepared when the report is published. 2008-04-10: Core response indicating that it is ok to contact any organization that AusCERT deems relevant for the stated purpose
. 2008-04-10: ArCert reports that it will start gathering information about appropriate organizations in Argentina to report the problem and start contacting them. 2008-04-11: CERT/CC reports that US-CERT has been made aware of the issue and will be kept updated going forward. If AusCERT is already in contact with the vendor CERT/CC will standby and follow AusCERT's lead. 2008-04-14: AusCERT reports that after several communication attempts the vendor said that it will address the issue in the next release of the product (by mid-year) and release a patch in a couple of months. However, the information is not to be considered an official statement and there is no official indication of a plan to provide immediate resolution. 2008-04-14: CERT/CC asks if Core will publish the advisory before mid-year and states concerns about the potential time elapsed between advisory publication and release of the fix. CERT/CC will likely put out information soon after Core does and expresses its interest to receive more information from the vendor regarding their response plan. 2008-04-14: AusCERT notes that Core has given the CERTs the time to notify possibly affected organizations before the report is published and requests any specific questions to be asked to the vendor. 2008-04-14: Core states that it is entirely possible to re-visit the publication date of the report (which has been done twice so far) but to do so Core requires concrete details and a committed date for the release of a fix noting that it wasn't until AusCERT's email from April 14th that the possibility that the vendor would release of a patch seemed realistic. Core is willing to postpone publication of the report provided that the vendor commits to release a fix no later than June 30th (the upper bound to the promised mid-year deadline indicated by the vendor). Core also reminds the CERTs that its intent in notifying them of the bug was to help to coordinate a way to address the bug should an official patch or fix is not made available by the vendor. 2008-04-24: Core sends an email to the 3 CERTs requesting a status update and any further details about the availability of fixes. Core would like to set a final date for the publication of its report. 2008-04-28: AusCERT indicates that after several calls and messages, the vendor has stated that it does not publish specific release schedules for updates and does not indicate what will or will not be their contents and that once a release is finalized all relevant materials are updated to reflect that fact. AusCERT asks about Core's plans regarding the issue. 2008-04-28: CERT/CC suggests that in light of the vendor statement one last effort should be attempted, setting a date for publication one or two weeks into the future and presenting the final drafts of the report to the vendor. 2008-04-28: Core sets the advisory publication date to May 12th and indicates to the three CERTs that the date is considered final unless concrete details about a patch release schedule are communicated no later than May 8th. The vendor has already been sent drafts of the advisory, the last one sent on March 25th, and Core has little confidence that the current status process will change in a positive manner. Core will consider the time up to May 12th as a period to finalize the preparation of guidance documents about how to deal with the issue without an official fix available. Should such a document be provided, Core is willing and open to include its recommendations in the security advisory. 2008-05-06: Core informs the CERTs that it is still editing its security advisory and that once the final draft is ready it will be sent for review to the vendor and the CERTs before it is published. Core informs that it will also issue a press release disclosing the issue and invites spokesmen from any of the CERTs to participate with a quote should they want to do so. 2008-05-08: CERT/CC acknowledges Core's email and thanks for the update indicating that it will not participate in a press release. 2008-05-14: Core sends its final draft of the security advisory to Citect and the 3 CERTs indicating that the publication date is set to May 19th, 2008 at approximately 3pm UTC. Should the vendor or the CERTS have any official comments or statements or workarounds that they would like to be included in Core's advisory they must be provided them by email no later than Friday May 16th 2008 at 9pm (UTC). 2008-05-15: Email from the vendor indicating the Citect has allocated resources to address the issue and is pleased to advise that a patch will be available by the end of May. The vendor assumes that publication of the advisory will be postponed given Core's previous email from April 14th stating that it is willing to review the publication date if the vendor commits to releasing a fix no later than June 30th. 2008-05-16: Email from CERT/CC asking about Core's plan to publish the advisory and stating that CERT/CC is inclined to hold off publication for a couple of weeks provided that Core does the same. JPCERT has been informed of the vulnerability to prepare for the upcoming disclosure. 2008-05-16: Core sends email to Citect and the three CERTs stating that publication of the advisory has been re-scheduled to June 2nd 2008 and reiterating that should the vendor want to include additional information or specific pointers to the patch it should be provided at least a day in advance. 2008-05-28: Core sends a follow up to the email sent on May 16th requesting confirmation that Citect is on track to release fixes for the vulnerability. Core had re-scheduled publication of the security advisory to June 2nd, 2008 (next Monday) and wants to confirm that software fixes will be ready to roll out and to provide the opportunity to include in the advisory any official guidelines on how to obtain them and/or any alternative workarounds to the problem. Specific questions about the potential workaround of disabling the vulnerable service are sent to the vendor as well as a request to provide a list of both vulnerable and not vulnerable packages. This information should be received no later than Friday June 30th, 2008 at 1pm UTC. 2008-06-01: Email received from the vendor stating: "The fix is on track and is currently in code review and testing stage. We will advise when and how the patch will be released". 2008-06-01: Core asks if the vendor has a concrete estimated date for the patch release. It is noted that publication of the security advisory was re-scheduled to June 2nd, 2008 on the basis of the vendor's commitment to release fixes "by the end of May" as indicated in the vendor's email from May 15th 2008. May is already past and Core still has no concrete details about when and how the fixes will be available. Core also notes that the previous email from May 28th 2008 had specific questions that may help craft guidance and recommendations for vulnerable organizations to mitigate risk due to the vendor's software security exposure and asks if the vendor is able to provide answers to those specific inquires. Core also states that it would like to discuss with the CERTs any specific details and information about their plans to address this issue in the upcoming week. In the absence of concrete fix details and workarounds from the vendor Core would like to coordinate with CERTs the dissemination of information to help reduce risk to vulnerable organizations worldwide. 2008-06-01: AusCERT indicates that it's ready for the publication and that it will publish its own report after Core has done so. 2008-06-04: Email from CERT/CC asking for a status update from Core and noting that neither the vendor patches nor Core's advisory have been published by June 2nd as planned. CERT/CC is ready to publish information about the issue and is willing to do so on Core's timetable. 2008-06-04: Citect informs that the patch for the reported issue has been completed at the code level and is being QA tested. The timing of software releases is a company commercial decision, and no guarantee of delivery dates is given. However, the vendor anticipates the patch will be published on its website in the next day or so, assuming QA approval is given. The vendor informs that the suggested workaround of disabling the ODBC server is viable for users that do not need this functionality (most users of CitectSCADA) and would not affect the operation of the software in any other way. The vendor states that "Although this patch will be made available to our supported customers, Citect maintains the stated stance that under NO circumstances should any SCADA/PLC/DCS/RTU/Process Control network should ever be exposed unprotected to the internet. The network should either be securely firewalled or better still isolated, or otherwise protected using approved IT security methodology. Citect has previously published security recommendations in a whitepaper located on our website at http://www.citect.com/documents/whitepapers/SCADA%20Security%20Whitepaper.pdf "SECURING AN INTEGRATED SCADA SYSTEM - Network Security & SCADA Systems Whitepaper". The vendor also indicates that "copies of the security alert report appear to have been circulated before the advised date of publication, contrary to the undertaking given to Citect."
. 2008-06-04: Core's email to Citect, AusCERT, CERT/CC and ArCert informing them that publication of the security advisory has now been re-scheduled to June 11th 2008. The date is final. The advisory will include references to the vendor's security recommendations and white paper as well as the proposed workaround. Core also indicates that to date the company has not published any report about the issue and has no indication of any such reports circulating "in the wild" but cannot discard that as a possibility given that the vendor's lack of proper secure communications procedures forced all the involved parties to communicate without any form of email encryption and that those communications have occurred over a public network such as the Internet for a period of over 4 months. 2008-06-04: Email from CERT/CC indicating that it will too publish a report on June 11th also noting the importance of sound system administration practices such as disabling unneeded features and a secure network architecture. CERT/CC agrees on the need of isolated or otherwise secured process control networks but indicates that in practice that is not always the case. Further information about any potential information leak is requested. 2008-06-10: Final draft of the advisory sent to Citect and CERTs, asking for confirmation that patches are now available. 2008-06-10: Citect confirms that patches are available to customers upon request and reiterates that the vendor's official stance is that the control network must be secured, and customers requesting the patch will be offered advice and links on how to do this. 2008-06-10: CERT/CC asks for any official guidance or wording that could be used in documents to direct readers appropriately. For example, an URL to a support/contact web site, or a case number. 2008-06-11: Security advisory CORE-2008-0125 published.
References
[1] Citect Corporate Profile http://www.citect.com/index.php?option=com_content&task=view&id=94&Itemid=151
About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://www.coresecurity.com/corelabs/.
About Core Security Technologies
Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the most comprehensive product for performing enterprise security assurance testing. CORE IMPACT evaluates network, endpoint and end-user vulnerabilities and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core augments its leading technology solution with world-class security consulting services, including penetration testing and software security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com.
Disclaimer
The contents of this advisory are copyright (c) 2008 Core Security Technologies and (c) 2008 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given.
GPG/PGP Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkhP2lEACgkQyNibggitWa29yQCdHfYtgLzOvys9Msi95eqF8H/X ADEAoKB9r52U9KXlEvBn5GgCaqXqC8OG =5qtX -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200806-0031",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "citectscada",
"scope": "eq",
"trust": 1.9,
"vendor": "citect",
"version": "7"
},
{
"model": "citectscada",
"scope": "eq",
"trust": 1.9,
"vendor": "citect",
"version": "6"
},
{
"model": "citectfacilities",
"scope": "eq",
"trust": 1.9,
"vendor": "citect",
"version": "7"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "citect",
"version": null
},
{
"model": "citectfacilities",
"scope": "eq",
"trust": 0.8,
"vendor": "citect",
"version": "v7"
},
{
"model": "citectscada",
"scope": "eq",
"trust": 0.8,
"vendor": "citect",
"version": "v6"
},
{
"model": "citectscada",
"scope": "eq",
"trust": 0.8,
"vendor": "citect",
"version": "v7"
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "citectfacilities",
"version": "7"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "citectscada",
"version": "6"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "citectscada",
"version": "7"
}
],
"sources": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#476345"
},
{
"db": "CNVD",
"id": "CNVD-2008-2883"
},
{
"db": "BID",
"id": "29634"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:citect:citectfacilities:7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citect:citectscada:6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:citect:citectscada:7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-2639"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sebastian Mu\u0026ntilde;iz",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
],
"trust": 0.6
},
"cve": "CVE-2008-2639",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.6,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2008-2639",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "7d760002-463f-11e9-b563-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-2639",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#476345",
"trust": 0.8,
"value": "7.35"
},
{
"author": "CNNVD",
"id": "CNNVD-200806-217",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#476345"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in the ODBC server service in Citect CitectSCADA 6 and 7, and CitectFacilities 7, allows remote attackers to execute arbitrary code via a long string in the second application packet in a TCP session on port 20222. Citect Made by company CitectSCADA Contains a buffer overflow vulnerability. Citect CitectSCADA Is SCADA (Supervisory Control And Data Acquisition) Software used for monitoring and control in the system. CitectSCADA Contains a buffer overflow vulnerability because it cannot properly handle crafted requests from clients.Arbitrary code is executed by a remote party or service operation is interrupted (DoS) There is a possibility of being attacked. \n\n\u00a0Citect SCADA and CitectFacilities include ODBC server functionality to provide remote SQL access to relational databases. The ODBC server component listens to client requests from the network on the port 20222 / tcp by default. The application layer protocol on TCP reads the 4-byte initial message to specify the length of the data in the next message, and then sockets from the same TCP. Word reads the next message of this length, where the first 5 bytes are a fixed header. After the second message in the network is read into the buffer, the data is copied to a fixed-size internal buffer on the stack. \n\n\u00a0Due to the lack of a correct length check of the data read, memory copy operations using fixed-size target buffers allocated on the stack may overflow, allowing unauthenticated remote attackers to execute arbitrary instructions on the vulnerable system . CitectSCADA is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. \nAttackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks will likely cause denial-of-service conditions. ----------------------------------------------------------------------\n\nWant a new job?\n\nhttp://secunia.com/secunia_security_specialist/\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\n\nInternational Partner Manager - Project Sales in the IT-Security\nIndustry:\nhttp://corporate.secunia.com/about_secunia/64/\n\n----------------------------------------------------------------------\n\nTITLE:\nCitect Products ODBC Server Component Buffer Overflow\n\nSECUNIA ADVISORY ID:\nSA30638\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/30638/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom local network\n\nSOFTWARE:\nCitectFacilities 7.x\nhttp://secunia.com/product/19043/\nCitectSCADA 6.x\nhttp://secunia.com/product/19041/\nCitectSCADA 7.x\nhttp://secunia.com/product/19042/\n\nDESCRIPTION:\nCore Security Technologies has reported a vulnerability in\nCitectSCADA and CitectFacilities, which can be exploited by malicious\npeople to cause a DoS (Denial of Service) or compromise a vulnerable\nsystem. \n\nThe vulnerability is reported in the following versions:\n* CitectSCADA v6\n* CitectSCADA v7\n* CitectFacilities v7\n\nSOLUTION:\nContact the vendor for patches. \n\nPROVIDED AND/OR DISCOVERED BY:\nSebasti\\xe1n Mu\\xf1iz, Core Security Technologies\n\nORIGINAL ADVISORY:\nCORE-2008-0125:\nhttp://www.coresecurity.com/index.php5?module=ContentMod\u0026action=item\u0026id=2186\n\nOTHER REFERENCES:\nUS-CERT VU#476345:\nhttp://www.kb.cert.org/vuls/id/476345\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n~ Core Security Technologies - CoreLabs Advisory\n~ http://www.coresecurity.com/corelabs/\n\n~ CitectSCADA ODBC service vulnerability\n\n\n*Advisory Information*\n\nTitle: CitectSCADA ODBC service vulnerability\nAdvisory ID: CORE-2008-0125\nAdvisory URL: http://www.coresecurity.com/?action=item\u0026id=2186\nDate published: 2008-06-11\nDate of last update: 2008-06-10\nVendors contacted: Citect\nRelease mode: Coordinated release\n\n\n*Vulnerability Information*\n\nClass: Buffer overflow\nRemotely Exploitable: Yes\nLocally Exploitable: Yes\nBugtraq ID: 29634\t\nCVE Name: CVE-2008-2639\t\n\n\n*Vulnerability Description*\n\nCitect is a supplier of industrial automation software with headquarters\nin Australia and over 20 offices in Oceania, South East Asia, China,\nJapan, the Americas, Europe, Africa and the Middle East. Citect\u0027s\nproducts are distributed in over 80 countries through a network of more\nthan 500 partners. According to Citect\u0027s website [1] the company, a\nfully owned subsidiary of Schneider Electric, has more than 150,000\nlicenses of its software sold to date. Citect\u0027s products are used by\norganizations worldwide in numerous industries including Aerospace \u0026\nDefense, Oil \u0026 Gas, Power/Utilities, Chemical, Pharmaceutical,\nManufacturing and others. with an integrated Human Machine Interface\n(HMI) / SCADA solution to deliver a scalable and reliable control and\nmonitoring system. The system is composed by software installed on\nstandard computer equipment running on commercial-of-the-shelf Microsoft\nWindows operating systems. To\naccomplish such goal the would-be attacker must be able to connect to\nthe vulnerable service on a TCP high-port. \n\n\n*Vulnerable Packages*\n\n. CitectSCADA v6\n. CitectSCADA v7\n. CitectFacilities v7\n\n\n*Non-vulnerable Packages*\n\n. Contact the vendor for fixed versions of the product. \n\n\n*Vendor Information, Solutions and Workarounds*\n\nIn general process control networks should be physically isolated from\ncorporate or other publicly accessible data networks as such an isolated\nnetwork will limit the exposure of systems with network facing\nvulnerabilities only to accidental disruption or potentially malicious\nusers or systems within the process control network itself. \n\nHowever, if physical isolation of the process control network is not\nfeasible it is strongly recommended to enforce and monitor strict\nnetwork access control mechanisms to verify that only the absolute\nminimal required set of systems from both within and outside the process\ncontrol network are allowed to connect to any systems within the process\ncontrol network. In this particular case, access control mechanisms on\nboth end-systems and network boundary devices such as firewalls and\nIPSes must ensure that only hardened and trusted systems from that\nminimal set can connect to systems in the process control network\nrunning potentially vulnerable software. Nonetheless systems on that\nminimal set must still be considered potential attack vectors into the\nprocess control network and should they become compromised, providers of\ntransitive trust from the process control network to external untrusted\nsystems. \n\nBesides the recommendation of a secure network architecture with strict\nnetwork access control measures, OS hardening and other sound system\nadministration practices a specific workaround for the vulnerability\nreported in this advisory is provided below. \n\nThe vulnerability is located in the ODBC server service, vulnerable\norganizations that do not require ODBC connectivity may disable the\nservice with no adverse effects to the CitectSCADA software. \nInstallations that require ODBC connectivity to SQL databases,\nspreadsheets, etc. will suffer loss of connection with ODBC data sources\nif this workaround is applied. Vulnerable organizations should obtain\npositive verification that ODBC connectivity is not necessary in their\ninstallation and prepare appropriate contingency procedures before the\nworkaround is applied. \n\nVendor statement:\n\nCitectSCADA is not designed to be accessible on public networks and\nrecommends that the SCADA and control networks be protected by firewall\nor similar on live sites. \n\nThe system must be network hardened regardless of the corrupt packet\nsoftware change to ensure a secure system given the likelihood that on\nthe same network are open industry standard protocol devices perhaps\ncommunicating via ethernet. \n\nPlease follow this link on Citect website under \"Industries and\nSolutions\" for security, that provides some information for customers\ninterested in securing their SCADA systems:\nhttp://www.citect.com/index.php?option=com_content\u0026task=view\u0026id=186\u0026Itemid=322\n\n\n*Credits*\n\nThis vulnerability was discovered and researched by Sebastian Mu\\xf1iz from\nthe Core IMPACT Exploit Writers Team (EWT) at Core Security\nTechnologies. Exploitation was further investigated by Nicolas Economou\nalso from the Core IMPACT Exploit Writers Team (EWT). \n\nCore would also like to thank Paul Fahey of AusCERT, Gaston Franco and\nPatricia Prandini of ArCERT and Art Manion and Chris Taschner of CERT/CC\nfor their assistance during the vulnerability reporting process. \n\nThis bug is a textbook example of a classic stack-based buffer overflow\nthat can be exploited by overwriting the return address of the currently\nrunning thread. The following binary excerpt shows the nature of the\nproblem:\n\n/-----------\n\n~ .text:0051BC33 loc_51BC33:\n~ .text:0051BC33 lea ecx, [ebp+pDestBuffer]\n~ .text:0051BC39 push ecx ; stack based buffer\n~ .text:0051BC3A mov edx, [ebp+arg_0]\n~ .text:0051BC3D push edx ; class that contains packet\n~ .text:0051BC3E call sub_52125A ; memcpy\n\n- -----------/\n\n\n\n*Report Timeline*\n\n. 2008-01-30:\nInitial contact mail sent by Core to Citect\u0027s support team. 2008-01-30:\nAdditional mail sent to Citect support team asking for a software\nsecurity contact at Citect. 2008-01-30:\nEmail from Citect\u0027s support team acknowledging notification and\nrequesting information in plaintext. 2008-02-06:\nCore sends the draft advisory, including proof of concept code to\ndemonstrate the vulnerability. 2008-02-28:\nCore requests a response from the vendor and asks for the vendor\u0027s plan\nto release fixes to vulnerable products. 2008-03-06:\nEmail from the vendor\u0027s technical architect confirms reception of the\nreport and indicating that there are not concerns around publication of\na security advisory disclosing the vulnerability. The vendor asks for a\nphone conference to ensure that both Core and Citect have a common\nunderstanding of the issue and expresses the possibility of adding\nadditional information to the advisory. The vendor also states that it\nwill formulate a plan for handling this issue. 2008-03-12:\nCore asks to continue the discussion concerning the vulnerability by\nmail so as to have all the involved parties informed simultaneously and\nall communications documented. Core requests confirmation that the\nvendor has been able to reproduce the vulnerability and requests details\nconcerning the plan to release fixes and asks for the additional\ninformation that the vendor would like to include in the advisory (in\nthe \"vendor information\" section). Core reminds the vendor that the\noriginal publication date of the advisory was February 25th and states\nthat the publication of the advisory is now re-scheduled to March 24th\nbecause fixed versions were not available at the date initially scheduled. 2008-03-25:\nVendor confirms that it reproduced and identified the vulnerability and\nindicates that the official stance is that CitectSCADA is not designed\nto be accessible on public networks and recommends that SCADA and\ncontrol networks are protected by firewalls and other security measures\non live sites. The vendor also states that it has no immediate plans to\nsupport CitectSCADA on public networks but is investigating the\npossibility of having a security audit of the product. 2008-03-25:\nCore notifies the vendor the intention to release the advisory on March\n26th given that the vendor has no immediate plans for fixing the\nvulnerability. 2008-03-26:\nCore consults under NDA with a process control security expert to obtain\na better understanding of the scope and impact of the vulnerability. The\nspecific technical details about the vulnerability are not disclosed,\nonly the general type of bug and the specific TCP port on which the\nvulnerable service listens are discussed. 2008-04-02:\nCore revisits its current plan to disclose the vulnerability and decides\nto get Computer Emergency Response Teams (CERTs) involved in the\nprocess. Core notifies the vendor that it will postpone the publication\nof the advisory, and that it will contact the Computer Emergency\nResponse Teams (CERTs) of countries were Core has physical offices\n(Argentina and USA) and the country were Citect has its headquarters\n(Australia). Core will then determine the contents and date of\npublication for the security advisory based on further communication\nwith the vendor and CERTs and more precise details that the vendor may\nprovide regarding availability of fixes. 2008-04-02:\nCore notifies the vendor that it will contact the CERTs of Australia,\nUSA and Argentina. Core reminds the vendor that the vulnerability\nreported is a classic example of a stack-based buffer overflow bug\ntrivial to exploit in present times and that although the previous email\nfrom the vendor provided a vague statement indicating that \"the scenario\nis under consideration for the next release\", to date there has not been\nany concrete details about development and release of fixes or a firm\ncommitment to any specific date to release them. 2008-04-08:\nCore sends an initial notification to AusCERT, CERT/CC and ArCert\nincluding a draft advisory describing the bug and the vendor\u0027s contact\ninformation, requesting an acknowledgement within 2 working days. 2008-04-08:\nAusCERT acknowledges reception of the advisory\n\n. 2008-04-09:\nArCERT acknowledges reception of the advisory\n\n. 2008-04-10:\nCERT/CC acknowledges reception of the advisory on a phone call\n\n. 2008-04-10:\nAusCERT notifies Core that so far it has not been able to contact the\nvendor and asks for approval to disseminate the information to the\nAustralian government and other national and international entities\noverlooking national infrastructure security. AusCERT also asks if CORE\nintends to publish the advisory and if so requests some time to be able\nto notify affected organizations. Meanwhile AusCERT indicates that it\nwill continue to try to work with the vendor. 2008-04-10:\nCore responds that it has no problems with AusCERT notifying other\nparties that may be able to better prepare risk mitigation procedures\nand/or work more closely with the vendor towards development and release\nof a fix. However, Core asks to keep the dissemination of the\ninformation to a minimum in order to avoid a potential leak. Core\nindicates that it has asked the vendor to provide concrete details about\nhow and when it plans to address the issue and that based on the\nresponse to that question it will determine a publication date for the\nsecurity advisory. Lacking a response from the vendor, Core will\ndetermine the publication date based on the feedback received from the\nCERTs and the progress of their preparations to address the report. 2008-04-10:\nAusCERT asks if it is ok to contact other CERTs and international\ngovernment communities to make them aware of the issue and to ensure\neveryone is prepared when the report is published. 2008-04-10:\nCore response indicating that it is ok to contact any organization that\nAusCERT deems relevant for the stated purpose\n\n. 2008-04-10:\nArCert reports that it will start gathering information about\nappropriate organizations in Argentina to report the problem and start\ncontacting them. 2008-04-11:\nCERT/CC reports that US-CERT has been made aware of the issue and will\nbe kept updated going forward. If AusCERT is already in contact with the\nvendor CERT/CC will standby and follow AusCERT\u0027s lead. 2008-04-14:\nAusCERT reports that after several communication attempts the vendor\nsaid that it will address the issue in the next release of the product\n(by mid-year) and release a patch in a couple of months. However, the\ninformation is not to be considered an official statement and there is\nno official indication of a plan to provide immediate resolution. 2008-04-14:\nCERT/CC asks if Core will publish the advisory before mid-year and\nstates concerns about the potential time elapsed between advisory\npublication and release of the fix. CERT/CC will likely put out\ninformation soon after Core does and expresses its interest to receive\nmore information from the vendor regarding their response plan. 2008-04-14:\nAusCERT notes that Core has given the CERTs the time to notify possibly\naffected organizations before the report is published and requests any\nspecific questions to be asked to the vendor. 2008-04-14:\nCore states that it is entirely possible to re-visit the publication\ndate of the report (which has been done twice so far) but to do so Core\nrequires concrete details and a committed date for the release of a fix\nnoting that it wasn\u0027t until AusCERT\u0027s email from April 14th that the\npossibility that the vendor would release of a patch seemed realistic. \nCore is willing to postpone publication of the report provided that the\nvendor commits to release a fix no later than June 30th (the upper bound\nto the promised mid-year deadline indicated by the vendor). Core also\nreminds the CERTs that its intent in notifying them of the bug was to\nhelp to coordinate a way to address the bug should an official patch or\nfix is not made available by the vendor. 2008-04-24:\nCore sends an email to the 3 CERTs requesting a status update and any\nfurther details about the availability of fixes. Core would like to set\na final date for the publication of its report. 2008-04-28:\nAusCERT indicates that after several calls and messages, the vendor has\nstated that it does not publish specific release schedules for updates\nand does not indicate what will or will not be their contents and that\nonce a release is finalized all relevant materials are updated to\nreflect that fact. AusCERT asks about Core\u0027s plans regarding the issue. 2008-04-28:\nCERT/CC suggests that in light of the vendor statement one last effort\nshould be attempted, setting a date for publication one or two weeks\ninto the future and presenting the final drafts of the report to the vendor. 2008-04-28:\nCore sets the advisory publication date to May 12th and indicates to the\nthree CERTs that the date is considered final unless concrete details\nabout a patch release schedule are communicated no later than May 8th. \nThe vendor has already been sent drafts of the advisory, the last one\nsent on March 25th, and Core has little confidence that the current\nstatus process will change in a positive manner. Core will consider the\ntime up to May 12th as a period to finalize the preparation of guidance\ndocuments about how to deal with the issue without an official fix\navailable. Should such a document be provided, Core is willing and open\nto include its recommendations in the security advisory. 2008-05-06:\nCore informs the CERTs that it is still editing its security advisory\nand that once the final draft is ready it will be sent for review to the\nvendor and the CERTs before it is published. Core informs that it will\nalso issue a press release disclosing the issue and invites spokesmen\nfrom any of the CERTs to participate with a quote should they want to do so. 2008-05-08:\nCERT/CC acknowledges Core\u0027s email and thanks for the update indicating\nthat it will not participate in a press release. 2008-05-14:\nCore sends its final draft of the security advisory to Citect and the 3\nCERTs indicating that the publication date is set to May 19th, 2008 at\napproximately 3pm UTC. Should the vendor or the CERTS have any official\ncomments or statements or workarounds that they would like to be\nincluded in Core\u0027s advisory they must be provided them by email no later\nthan Friday May 16th 2008 at 9pm (UTC). 2008-05-15:\nEmail from the vendor indicating the Citect has allocated resources to\naddress the issue and is pleased to advise that a patch will be\navailable by the end of May. The vendor assumes that publication of the\nadvisory will be postponed given Core\u0027s previous email from April 14th\nstating that it is willing to review the publication date if the vendor\ncommits to releasing a fix no later than June 30th. 2008-05-16:\nEmail from CERT/CC asking about Core\u0027s plan to publish the advisory and\nstating that CERT/CC is inclined to hold off publication for a couple of\nweeks provided that Core does the same. JPCERT has been informed of the\nvulnerability to prepare for the upcoming disclosure. 2008-05-16:\nCore sends email to Citect and the three CERTs stating that publication\nof the advisory has been re-scheduled to June 2nd 2008 and reiterating\nthat should the vendor want to include additional information or\nspecific pointers to the patch it should be provided at least a day in\nadvance. 2008-05-28:\nCore sends a follow up to the email sent on May 16th requesting\nconfirmation that Citect is on track to release fixes for the\nvulnerability. Core had re-scheduled publication of the security\nadvisory to June 2nd, 2008 (next Monday) and wants to confirm that\nsoftware fixes will be ready to roll out and to provide the opportunity\nto include in the advisory any official guidelines on how to obtain them\nand/or any alternative workarounds to the problem. Specific questions\nabout the potential workaround of disabling the vulnerable service are\nsent to the vendor as well as a request to provide a list of both\nvulnerable and not vulnerable packages. This information should be\nreceived no later than Friday June 30th, 2008 at 1pm UTC. 2008-06-01:\nEmail received from the vendor stating: \"The fix is on track and is\ncurrently in code review and testing stage. We will advise when and how\nthe patch will be released\". 2008-06-01:\nCore asks if the vendor has a concrete estimated date for the patch\nrelease. It is noted that publication of the security advisory was\nre-scheduled to June 2nd, 2008 on the basis of the vendor\u0027s commitment\nto release fixes \"by the end of May\" as indicated in the vendor\u0027s email\nfrom May 15th 2008. May is already past and Core still has no concrete\ndetails about when and how the fixes will be available. Core also notes\nthat the previous email from May 28th 2008 had specific questions that\nmay help craft guidance and recommendations for vulnerable organizations\nto mitigate risk due to the vendor\u0027s software security exposure and asks\nif the vendor is able to provide answers to those specific inquires. \nCore also states that it would like to discuss with the CERTs any\nspecific details and information about their plans to address this issue\nin the upcoming week. In the absence of concrete fix details and\nworkarounds from the vendor Core would like to coordinate with CERTs the\ndissemination of information to help reduce risk to vulnerable\norganizations worldwide. 2008-06-01:\nAusCERT indicates that it\u0027s ready for the publication and that it will\npublish its own report after Core has done so. 2008-06-04:\nEmail from CERT/CC asking for a status update from Core and noting that\nneither the vendor patches nor Core\u0027s advisory have been published by\nJune 2nd as planned. CERT/CC is ready to publish information about the\nissue and is willing to do so on Core\u0027s timetable. 2008-06-04:\nCitect informs that the patch for the reported issue has been completed\nat the code level and is being QA tested. The timing of software\nreleases is a company commercial decision, and no guarantee of delivery\ndates is given. However, the vendor anticipates the patch will be\npublished on its website in the next day or so, assuming QA approval is\ngiven. The vendor informs that the suggested workaround of disabling\nthe ODBC server is viable for users that do not need this functionality\n(most users of CitectSCADA) and would not affect the operation of the\nsoftware in any other way. \nThe vendor states that \"Although this patch will be made available to\nour supported customers, Citect maintains the stated stance that under\nNO circumstances should any SCADA/PLC/DCS/RTU/Process Control network\nshould ever be exposed unprotected to the internet. The network should\neither be securely firewalled or better still isolated, or otherwise\nprotected using approved IT security methodology. Citect has previously\npublished security recommendations in a whitepaper located on our\nwebsite at\nhttp://www.citect.com/documents/whitepapers/SCADA%20Security%20Whitepaper.pdf\n\"SECURING AN INTEGRATED SCADA SYSTEM - Network Security \u0026 SCADA Systems\nWhitepaper\". The vendor also indicates that \"copies of the security\nalert report appear to have been circulated before the advised date of\npublication, contrary to the undertaking given to Citect.\"\n\n. 2008-06-04:\nCore\u0027s email to Citect, AusCERT, CERT/CC and ArCert informing them that\npublication of the security advisory has now been re-scheduled to June\n11th 2008. The date is final. The advisory will include references to\nthe vendor\u0027s security recommendations and white paper as well as the\nproposed workaround. Core also indicates that to date the company has\nnot published any report about the issue and has no indication of any\nsuch reports circulating \"in the wild\" but cannot discard that as a\npossibility given that the vendor\u0027s lack of proper secure communications\nprocedures forced all the involved parties to communicate without any\nform of email encryption and that those communications have occurred\nover a public network such as the Internet for a period of over 4 months. 2008-06-04:\nEmail from CERT/CC indicating that it will too publish a report on June\n11th also noting the importance of sound system administration practices\nsuch as disabling unneeded features and a secure network architecture. \nCERT/CC agrees on the need of isolated or otherwise secured process\ncontrol networks but indicates that in practice that is not always the\ncase. Further information about any potential information leak is requested. 2008-06-10:\nFinal draft of the advisory sent to Citect and CERTs, asking for\nconfirmation that patches are now available. 2008-06-10:\nCitect confirms that patches are available to customers upon request and\nreiterates that the vendor\u0027s official stance is that the control network\nmust be secured, and customers requesting the patch will be offered\nadvice and links on how to do this. 2008-06-10:\nCERT/CC asks for any official guidance or wording that could be used in\ndocuments to direct readers appropriately. For example, an URL to a\nsupport/contact web site, or a case number. 2008-06-11:\nSecurity advisory CORE-2008-0125 published. \n\n\n\n*References*\n\n[1] Citect Corporate Profile\nhttp://www.citect.com/index.php?option=com_content\u0026task=view\u0026id=94\u0026Itemid=151\n\n\n*About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://www.coresecurity.com/corelabs/. \n\n\n*About Core Security Technologies*\n\nCore Security Technologies develops strategic solutions that help\nsecurity-conscious organizations worldwide develop and maintain a\nproactive process for securing their networks. The company\u0027s flagship\nproduct, CORE IMPACT, is the most comprehensive product for performing\nenterprise security assurance testing. CORE IMPACT evaluates network,\nendpoint and end-user vulnerabilities and identifies what resources are\nexposed. It enables organizations to determine if current security\ninvestments are detecting and preventing attacks. Core augments its\nleading technology solution with world-class security consulting\nservices, including penetration testing and software security auditing. \nBased in Boston, MA and Buenos Aires, Argentina, Core Security\nTechnologies can be reached at 617-399-6980 or on the Web at\nhttp://www.coresecurity.com. \n\n\n*Disclaimer*\n\nThe contents of this advisory are copyright (c) 2008 Core Security\nTechnologies and (c) 2008 CoreLabs, and may be distributed freely\nprovided that no fee is charged for this distribution and proper credit\nis given. \n\n\n*GPG/PGP Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.8 (MingW32)\nComment: Using GnuPG with Mozilla - http://enigmail.mozdev.org\n\niEYEARECAAYFAkhP2lEACgkQyNibggitWa29yQCdHfYtgLzOvys9Msi95eqF8H/X\nADEAoKB9r52U9KXlEvBn5GgCaqXqC8OG\n=5qtX\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"db": "CERT/CC",
"id": "VU#476345"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"db": "CNVD",
"id": "CNVD-2008-2883"
},
{
"db": "BID",
"id": "29634"
},
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "PACKETSTORM",
"id": "67260"
},
{
"db": "PACKETSTORM",
"id": "67189"
}
],
"trust": 3.69
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-2639",
"trust": 3.8
},
{
"db": "CERT/CC",
"id": "VU#476345",
"trust": 3.6
},
{
"db": "BID",
"id": "29634",
"trust": 3.5
},
{
"db": "SECUNIA",
"id": "30638",
"trust": 3.4
},
{
"db": "EXPLOIT-DB",
"id": "6387",
"trust": 2.4
},
{
"db": "SECTRACK",
"id": "1020241",
"trust": 2.4
},
{
"db": "SREASON",
"id": "3944",
"trust": 1.6
},
{
"db": "VUPEN",
"id": "ADV-2008-1834",
"trust": 1.6
},
{
"db": "XF",
"id": "42992",
"trust": 1.4
},
{
"db": "CNVD",
"id": "CNVD-2008-2883",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001454",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20080611 CORE-2008-0125: CITECTSCADA ODBC SERVICE VULNERABILITY",
"trust": 0.6
},
{
"db": "MILW0RM",
"id": "6387",
"trust": 0.6
},
{
"db": "IVD",
"id": "7D760002-463F-11E9-B563-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "B0301A90-23CD-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "67260",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "67189",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#476345"
},
{
"db": "CNVD",
"id": "CNVD-2008-2883"
},
{
"db": "BID",
"id": "29634"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"db": "PACKETSTORM",
"id": "67260"
},
{
"db": "PACKETSTORM",
"id": "67189"
},
{
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
]
},
"id": "VAR-200806-0031",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2008-2883"
}
],
"trust": 1.613095215
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2008-2883"
}
]
},
"last_update_date": "2023-12-18T12:12:07.484000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Securing Your SCADA Network",
"trust": 0.8,
"url": "http://www.citect.com/index.php?option=com_content\u0026task=view\u0026id=186\u0026itemid=322"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"db": "NVD",
"id": "CVE-2008-2639"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://www.kb.cert.org/vuls/id/476345"
},
{
"trust": 2.4,
"url": "http://secunia.com/advisories/30638"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/29634"
},
{
"trust": 2.4,
"url": "http://securitytracker.com/id?1020241"
},
{
"trust": 2.0,
"url": "http://www.coresecurity.com/?action=item\u0026id=2186"
},
{
"trust": 1.6,
"url": "http://www.citect.com/index.php?option=com_content\u0026task=view\u0026id=1374\u0026itemid=223"
},
{
"trust": 1.6,
"url": "http://isc.sans.org/diary.html?storyid=4556"
},
{
"trust": 1.6,
"url": "http://securityreason.com/securityalert/3944"
},
{
"trust": 1.6,
"url": "http://www.kb.cert.org/vuls/id/ctar-7enqnh"
},
{
"trust": 1.4,
"url": "http://www.milw0rm.com/exploits/6387"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/42992"
},
{
"trust": 1.2,
"url": "http://www.citect.com/index.php?option=com_content\u0026task=view\u0026id=186\u0026itemid=322"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/archive/1/493272/100/0/threaded"
},
{
"trust": 1.0,
"url": "http://www.vupen.com/english/advisories/2008/1834/references"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42992"
},
{
"trust": 1.0,
"url": "https://www.exploit-db.com/exploits/6387"
},
{
"trust": 0.9,
"url": "http://www.coresecurity.com/index.php5?module=contentmod\u0026action=item\u0026id=2186"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/30638/"
},
{
"trust": 0.8,
"url": "http://www.citect.com/index.php?option=com_content\u0026task=view\u0026id=26\u0026itemid=29"
},
{
"trust": 0.8,
"url": "http://www.citect.com/documents/news_and_media/pr-citect-address-security.pdf"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/29634/discuss"
},
{
"trust": 0.8,
"url": "http://news.infracritical.com/pipermail/scadasec/2008-september/001503.html"
},
{
"trust": 0.8,
"url": "http://www.digitalmunition.com/5ws_of_citect_odbc.txt"
},
{
"trust": 0.8,
"url": "http://www.digitalmunition.com/citect_scada_odbc.rb"
},
{
"trust": 0.8,
"url": "http://www.milw0rm.com/papers/221"
},
{
"trust": 0.8,
"url": "http://www.citect.com/documents/news_and_media/citectscada-security-response.pdf"
},
{
"trust": 0.8,
"url": "http://www.csoonline.com/article/print/448626"
},
{
"trust": 0.8,
"url": "http://www.pcworld.com/businesscenter/article/150888/computer_threat_for_industrial_systems_now_more_serious.html"
},
{
"trust": 0.8,
"url": "http://www.theregister.co.uk/2008/09/19/scada_advisory_pulled/"
},
{
"trust": 0.8,
"url": "http://knowledgebase.citect.com/safetyandsecurity/"
},
{
"trust": 0.8,
"url": "http://www.digitalbond.com/wiki/index.php/citectscada_stack_overflow_vulnerability"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2639"
},
{
"trust": 0.8,
"url": "http://www.frsirt.com/english/advisories/2008/1803"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu476345/"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2639"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/493272/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/1834/references"
},
{
"trust": 0.3,
"url": "http://www.citect.com"
},
{
"trust": 0.3,
"url": "/archive/1/493272"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19041/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_specialist/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19042/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/about_secunia/64/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19043/"
},
{
"trust": 0.1,
"url": "http://www.citect.com/index.php?option=com_content\u0026task=view\u0026id=94\u0026itemid=151"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "http://enigmail.mozdev.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-2639"
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/corelabs/."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/corelabs/"
},
{
"trust": 0.1,
"url": "http://www.citect.com/documents/whitepapers/scada%20security%20whitepaper.pdf"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#476345"
},
{
"db": "BID",
"id": "29634"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"db": "PACKETSTORM",
"id": "67260"
},
{
"db": "PACKETSTORM",
"id": "67189"
},
{
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#476345"
},
{
"db": "CNVD",
"id": "CNVD-2008-2883"
},
{
"db": "BID",
"id": "29634"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"db": "PACKETSTORM",
"id": "67260"
},
{
"db": "PACKETSTORM",
"id": "67189"
},
{
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-06-11T00:00:00",
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"date": "2008-06-11T00:00:00",
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"date": "2008-06-11T00:00:00",
"db": "CERT/CC",
"id": "VU#476345"
},
{
"date": "2008-06-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-2883"
},
{
"date": "2008-06-11T00:00:00",
"db": "BID",
"id": "29634"
},
{
"date": "2008-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"date": "2008-06-13T01:45:00",
"db": "PACKETSTORM",
"id": "67260"
},
{
"date": "2008-06-11T18:49:38",
"db": "PACKETSTORM",
"id": "67189"
},
{
"date": "2008-06-16T18:41:00",
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"date": "2008-06-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-10-08T00:00:00",
"db": "CERT/CC",
"id": "VU#476345"
},
{
"date": "2008-06-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-2883"
},
{
"date": "2008-09-08T17:51:00",
"db": "BID",
"id": "29634"
},
{
"date": "2008-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001454"
},
{
"date": "2018-10-11T20:42:00.677000",
"db": "NVD",
"id": "CVE-2008-2639"
},
{
"date": "2009-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "67189"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Citect SCADA ODBC Server Remote Stack Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2008-2883"
}
],
"trust": 1.0
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "7d760002-463f-11e9-b563-000c29342cb1"
},
{
"db": "IVD",
"id": "b0301a90-23cd-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-217"
}
],
"trust": 1.0
}
}
VAR-202103-0944
Vulnerability from variot - Updated: 2023-12-18 11:57This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue results from the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-12309. Zero Day Initiative To this vulnerability ZDI-CAN-12309 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. TP-Link Archer A7 is a network router device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202103-0944",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "archer a7",
"scope": "lt",
"trust": 1.0,
"vendor": "tp link",
"version": "c7\\(us\\)_v5_210125"
},
{
"model": "archer a7",
"scope": "lt",
"trust": 1.0,
"vendor": "tp link",
"version": "a7\\(us\\)_v5_200220"
},
{
"model": "archer a7",
"scope": "eq",
"trust": 0.8,
"vendor": "tp link",
"version": null
},
{
"model": "archer a7",
"scope": "eq",
"trust": 0.8,
"vendor": "tp link",
"version": "archer a7 firmware archer c7 (us)_v5_210125"
},
{
"model": "archer a7",
"scope": "eq",
"trust": 0.8,
"vendor": "tp link",
"version": "archer a7 firmware archer a7 (us)_v5_200220 ac1750"
},
{
"model": "archer a7",
"scope": null,
"trust": 0.7,
"vendor": "tp link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-214"
},
{
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "NVD",
"id": "CVE-2021-27245"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:tp-link:archer_a7_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "c7\\(us\\)_v5_210125",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:tp-link:archer_a7:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:tp-link:archer_a7_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "a7\\(us\\)_v5_200220",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:tp-link:archer_a7:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-27245"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Team FLASHBACK: Pedro Ribeiro (@pedrib1337 | pedrib@gmail.com) + Radek Domanski (@RabbitPro)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-214"
}
],
"trust": 0.7
},
"cve": "CVE-2021-27245",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2021-27245",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2022-21175",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.1,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-27245",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"id": "CVE-2021-27245",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-27245",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2021-27245",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2021-27245",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2022-21175",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202103-1594",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2021-27245",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-214"
},
{
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"db": "VULMON",
"id": "CVE-2021-27245"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue results from the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-12309. Zero Day Initiative To this vulnerability ZDI-CAN-12309 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. TP-Link Archer A7 is a network router device",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "ZDI",
"id": "ZDI-21-214"
},
{
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"db": "VULMON",
"id": "CVE-2021-27245"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-27245",
"trust": 3.8
},
{
"db": "ZDI",
"id": "ZDI-21-214",
"trust": 3.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-12309",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2022-21175",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202103-1594",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-27245",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-214"
},
{
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"db": "VULMON",
"id": "CVE-2021-27245"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
]
},
"id": "VAR-202103-0944",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-21175"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-21175"
}
]
},
"last_update_date": "2023-12-18T11:57:30.444000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.tp-link.com/us/"
},
{
"title": "Patch for TP-Link Archer A7 Security Bypass Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/326736"
},
{
"title": "TP-Link Archer A7 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=145604"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-693",
"trust": 1.0
},
{
"problemtype": "Malfunction of protection mechanism (CWE-693) [ Other ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "NVD",
"id": "CVE-2021-27245"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://www.zerodayinitiative.com/advisories/zdi-21-214/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-27245"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/693.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"db": "VULMON",
"id": "CVE-2021-27245"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-21-214"
},
{
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"db": "VULMON",
"id": "CVE-2021-27245"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-02-24T00:00:00",
"db": "ZDI",
"id": "ZDI-21-214"
},
{
"date": "2021-03-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"date": "2021-03-29T00:00:00",
"db": "VULMON",
"id": "CVE-2021-27245"
},
{
"date": "2021-12-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"date": "2021-03-29T21:15:12.953000",
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"date": "2021-03-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-03-19T00:00:00",
"db": "ZDI",
"id": "ZDI-21-214"
},
{
"date": "2022-03-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-21175"
},
{
"date": "2021-04-01T00:00:00",
"db": "VULMON",
"id": "CVE-2021-27245"
},
{
"date": "2021-12-01T09:03:00",
"db": "JVNDB",
"id": "JVNDB-2021-004875"
},
{
"date": "2021-04-01T18:46:55.337000",
"db": "NVD",
"id": "CVE-2021-27245"
},
{
"date": "2021-04-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TP-Link\u00a0Archer\u00a0A7\u00a0 Vulnerability regarding a defect in the protection mechanism in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-004875"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202103-1594"
}
],
"trust": 0.6
}
}
VAR-200803-0049
Vulnerability from variot - Updated: 2023-12-18 11:48Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter, as demonstrated by a request for advanced/portforw.htm on the fwan page. The nslookup command fails to drop privileges, allowing local attackers to gain root privileges. D-Link is an internationally renowned provider of network equipment and solutions, and its products include a variety of router equipment.
D-Link DI-524 has multiple vulnerabilities in processing user requests. Remote attackers may use these vulnerabilities to make device services unavailable or perform cross-site scripting attacks.
The D-Link DI-524 router does not properly handle the login request sent to the web interface. If the attacker sends a long username, it will trigger a crash; if the long HTTP header is sent, it may also cause the router's web server. collapse.
The D-Link DI-604 router did not properly filter the input passed to the rf parameter in prim.htm and returned it to the user, which could cause arbitrary HTML and script code to be executed in the user's browser session.
The D-Link DSL-G604T router did not properly filter the input passed to the var: category parameter in cgi-bin / webcm and returned it to the user, which could cause arbitrary HTML and script code to be executed in the user's browser session. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. D-Link is a network company founded by Taiwan D-Link Group, dedicated to the R&D, production and marketing of LAN, broadband network, wireless network, voice network and related network equipment. ----------------------------------------------------------------------
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched.
Download and test it today: https://psi.secunia.com/
Read more about this new version: https://psi.secunia.com/?page=changelog
TITLE: D-Link DSL-G604T "var:category" Cross-Site Scripting Vulnerability
SECUNIA ADVISORY ID: SA29530
VERIFY ADVISORY: http://secunia.com/advisories/29530/
CRITICAL: Less critical
IMPACT: Cross Site Scripting
WHERE:
From remote
OPERATING SYSTEM: D-Link DSL-G604T http://secunia.com/product/5127/
DESCRIPTION: Gareth Heyes has reported a vulnerability in D-Link DSL-G604T, which can be exploited by malicious people to conduct cross-site scripting attacks.
SOLUTION: Do not browse untrusted websites or follow untrusted links while logged on to the application.
PROVIDED AND/OR DISCOVERED BY: Gareth Heyes
ORIGINAL ADVISORY: http://www.gnucitizen.org/projects/router-hacking-challenge/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200803-0049",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dsl-g604t",
"scope": null,
"trust": 1.7,
"vendor": "d link",
"version": null
},
{
"model": "dsl-g604t",
"scope": "eq",
"trust": 1.0,
"vendor": "d link",
"version": "*"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "di-604",
"scope": null,
"trust": 0.3,
"vendor": "d link",
"version": null
},
{
"model": "di-524",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#18419"
},
{
"db": "CNVD",
"id": "CNVD-2008-5921"
},
{
"db": "BID",
"id": "28439"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:d-link:dsl-g604t:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-1253"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Gareth Heyes\nlaurent",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
],
"trust": 0.6
},
"cve": "CVE-2008-1253",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2008-1253",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-31378",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-1253",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#18419",
"trust": 0.8,
"value": "2.76"
},
{
"author": "CNNVD",
"id": "CNNVD-200803-131",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-31378",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#18419"
},
{
"db": "VULHUB",
"id": "VHN-31378"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter, as demonstrated by a request for advanced/portforw.htm on the fwan page. The nslookup command fails to drop privileges, allowing local attackers to gain root privileges. D-Link is an internationally renowned provider of network equipment and solutions, and its products include a variety of router equipment. \n\n\u00a0D-Link DI-524 has multiple vulnerabilities in processing user requests. Remote attackers may use these vulnerabilities to make device services unavailable or perform cross-site scripting attacks. \n\n\u00a0The D-Link DI-524 router does not properly handle the login request sent to the web interface. If the attacker sends a long username, it will trigger a crash; if the long HTTP header is sent, it may also cause the router\u0027s web server. collapse. \n\n\u00a0The D-Link DI-604 router did not properly filter the input passed to the rf parameter in prim.htm and returned it to the user, which could cause arbitrary HTML and script code to be executed in the user\u0027s browser session. \n\n\u00a0The D-Link DSL-G604T router did not properly filter the input passed to the var: category parameter in cgi-bin / webcm and returned it to the user, which could cause arbitrary HTML and script code to be executed in the user\u0027s browser session. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. D-Link is a network company founded by Taiwan D-Link Group, dedicated to the R\u0026D, production and marketing of LAN, broadband network, wireless network, voice network and related network equipment. ----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \n\nDownload and test it today:\nhttps://psi.secunia.com/\n\nRead more about this new version:\nhttps://psi.secunia.com/?page=changelog\n\n----------------------------------------------------------------------\n\nTITLE:\nD-Link DSL-G604T \"var:category\" Cross-Site Scripting Vulnerability\n\nSECUNIA ADVISORY ID:\nSA29530\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/29530/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nCross Site Scripting\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nD-Link DSL-G604T\nhttp://secunia.com/product/5127/\n\nDESCRIPTION:\nGareth Heyes has reported a vulnerability in D-Link DSL-G604T, which\ncan be exploited by malicious people to conduct cross-site scripting\nattacks. \n\nSOLUTION:\nDo not browse untrusted websites or follow untrusted links while\nlogged on to the application. \n\nPROVIDED AND/OR DISCOVERED BY:\nGareth Heyes\n\nORIGINAL ADVISORY:\nhttp://www.gnucitizen.org/projects/router-hacking-challenge/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"db": "CERT/CC",
"id": "VU#18419"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"db": "CNVD",
"id": "CNVD-2008-5921"
},
{
"db": "BID",
"id": "28439"
},
{
"db": "VULHUB",
"id": "VHN-31378"
},
{
"db": "PACKETSTORM",
"id": "64868"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-1253",
"trust": 3.4
},
{
"db": "BID",
"id": "28439",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "29530",
"trust": 1.8
},
{
"db": "XF",
"id": "604",
"trust": 1.4
},
{
"db": "CERT/CC",
"id": "VU#18419",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200803-131",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2008-5921",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080301 THE ROUTER HACKING CHALLENGE IS OVER!",
"trust": 0.6
},
{
"db": "XF",
"id": "41117",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-31378",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64868",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#18419"
},
{
"db": "CNVD",
"id": "CNVD-2008-5921"
},
{
"db": "VULHUB",
"id": "VHN-31378"
},
{
"db": "BID",
"id": "28439"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"db": "PACKETSTORM",
"id": "64868"
},
{
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
]
},
"id": "VAR-200803-0049",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2008-5921"
},
{
"db": "VULHUB",
"id": "VHN-31378"
}
],
"trust": 1.2214285999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2008-5921"
}
]
},
"last_update_date": "2023-12-18T11:48:03.146000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.dlink.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31378"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"db": "NVD",
"id": "CVE-2008-1253"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://www.gnucitizen.org/projects/router-hacking-challenge/"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/28439"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/29530"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/489009/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41117"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/static/604.php"
},
{
"trust": 0.8,
"url": "http://groups.google.com/groups?q=ers-sva-e01-1997:008.1\u0026hl=en\u0026rnum=3\u0026selm=6383r7%24kts%243%40watnews1.watson.ibm.com"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-1253"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-1253"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/489009/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/41117"
},
{
"trust": 0.3,
"url": "http://www.d-link.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29530/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/?page=changelog"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5127/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#18419"
},
{
"db": "VULHUB",
"id": "VHN-31378"
},
{
"db": "BID",
"id": "28439"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"db": "PACKETSTORM",
"id": "64868"
},
{
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#18419"
},
{
"db": "CNVD",
"id": "CNVD-2008-5921"
},
{
"db": "VULHUB",
"id": "VHN-31378"
},
{
"db": "BID",
"id": "28439"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"db": "PACKETSTORM",
"id": "64868"
},
{
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-09-26T00:00:00",
"db": "CERT/CC",
"id": "VU#18419"
},
{
"date": "2008-12-07T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-5921"
},
{
"date": "2008-03-10T00:00:00",
"db": "VULHUB",
"id": "VHN-31378"
},
{
"date": "2008-03-25T00:00:00",
"db": "BID",
"id": "28439"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"date": "2008-03-26T00:09:25",
"db": "PACKETSTORM",
"id": "64868"
},
{
"date": "2008-03-10T17:44:00",
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"date": "2008-03-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2001-09-27T00:00:00",
"db": "CERT/CC",
"id": "VU#18419"
},
{
"date": "2008-12-07T00:00:00",
"db": "CNVD",
"id": "CNVD-2008-5921"
},
{
"date": "2018-10-11T00:00:00",
"db": "VULHUB",
"id": "VHN-31378"
},
{
"date": "2008-03-26T16:10:00",
"db": "BID",
"id": "28439"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002825"
},
{
"date": "2018-10-11T20:31:20.247000",
"db": "NVD",
"id": "CVE-2008-1253"
},
{
"date": "2008-09-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM AIX nslookup fails to drop root privileges",
"sources": [
{
"db": "CERT/CC",
"id": "VU#18419"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "64868"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-131"
}
],
"trust": 0.7
}
}