PT-2002-2883 · Working Resources · Badblue Enterprise Edition

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2170

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Working Resources Inc. BadBlue Enterprise Edition versions 1.7 through 1.74

Description: The issue allows remote attackers to execute arbitrary code by accessing the dir.hts page on the localhost and adding an entire hard drive to be shared, due to insufficient authentication. This is possible because the software attempts to restrict administrator actions to the IP address of the local host but does not provide additional authentication.

Recommendations: For versions 1.7 through 1.74, consider restricting access to the dir.hts page to minimize the risk of exploitation. As a temporary workaround, limit the ability to add entire hard drives to be shared until a more robust authentication mechanism is implemented.

Exploit

Correção

Identificadores relacionados

CVE-2002-2170

Produtos afetados

Badblue Enterprise Edition

Referências · 6

• 🔥 https://exploit-db.com/exploits/21630 · Exploit
• 🔥 http://securityfocus.com/bid/5276 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2170 · Nota
• http://iss.net/security_center/static/9642.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2170 · Nota de Segurança
• http://online.securityfocus.com/archive/1/283418 · Nota