PT-2001-1833 · Raytheon · Silentrunner

Publicado 2001-08-29 · Atualizado 2008-09-05 · CVE-2001-0636

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Raytheon SilentRunner versions 2.0 through 2.0.1

Description: The issue concerns buffer overflows that can be exploited by remote attackers. There are two main ways this can happen: (1) by causing a denial of service in the collector component (cle.exe) through traffic containing long passwords, or (2) by executing arbitrary commands via long HTTP queries in the Knowledge Browser component.

Recommendations: For version 2.0, consider restricting access to the collector component to prevent denial of service attacks, and limit the length of HTTP queries in the Knowledge Browser component to prevent arbitrary command execution. For version 2.0.1, limit the length of HTTP queries in the Knowledge Browser component to prevent arbitrary command execution, and restrict access to the collector component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2001-0636

Produtos afetados

Silentrunner

Referências · 2

• http://xforce.iss.net/alerts/advise91.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-0636 · Nota de Segurança