PT-2004-3577 · Distcc+1 · Distcc+1

Publicado 2004-12-31 · Atualizado 2008-09-05 · CVE-2004-2687

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions distcc versions 2.x

Description The issue allows remote attackers to execute arbitrary commands via compilation jobs. This is possible because the server does not perform authorization checks when executing compilation jobs.

Recommendations For distcc version 2.x, configure the server to restrict access to the server port to prevent unauthorized access.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2004-2687

Produtos afetados

Samba

Distcc

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/misc/distcc_exec.rb · Exploit
• 🔥 http://metasploit.org/projects/Framework/exploits.html#distcc_exec · Exploit
• 🔥 https://exploit-db.com/exploits/9915 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2004-2687 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2004-2687 · Aviso do Fabricante
• http://lists.samba.org/archive/distcc/2004q3/002550.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2687 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2005-03/0183.html · Nota
• http://lists.samba.org/archive/distcc/2004q3/002562.html · Nota
• http://distcc.samba.org/security.html · Nota
• http://osvdb.org/13378 · Nota
• https://samba.org/samba/security/CVE-2004-2687 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2687 · Aviso do Fabricante