PT-2001-2271 · Progress · Progress

Publicado 2001-11-02 · Atualizado 2017-12-19 · CVE-2001-1129

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Progress database version 9.1C

Description The issue allows a local user to execute arbitrary code via format string specifiers in the file used by the PROMSGS environment variable. This is due to format string vulnerabilities in multiple components, including probuild, dbutil, mprosrv, mprshut, proapsv, progres, proutil, rfutil, and prolib.

Recommendations For Progress database version 9.1C, consider restricting access to the PROMSGS environment variable to minimize the risk of exploitation. As a temporary workaround, avoid using format string specifiers in the file used by the PROMSGS environment variable until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2001-1129

Produtos afetados

Progress

Referências · 4

• http://securityfocus.com/bid/3502 · Aviso do Fabricante
• http://securityfocus.com/archive/1/224395 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7457 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1129 · Nota de Segurança