PT-2010-1425 · South River Technologies · Webdrive

Publicado 2010-01-13 · Atualizado 2018-10-10 · CVE-2009-4606

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions South River Technologies WebDrive version 9.02 build 2232

Description The issue allows local users to manipulate the WebDrive Service, which was installed without a security descriptor. This enables users to stop the service, execute arbitrary commands as SYSTEM by modifying the binPath variable using the config command, or restart the service.

Recommendations For version 9.02 build 2232, consider setting a proper security descriptor for the WebDrive Service to restrict unauthorized access and modifications. As a temporary workaround, restrict access to the service's configuration to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-4606

Produtos afetados

Webdrive

Referências · 8

• 🔥 https://exploit-db.com/exploits/11264 · Exploit
• http://osvdb.org/59080 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4606 · Nota de Segurança
• http://secunia.com/advisories/37083 · Aviso do Fabricante
• http://retrogod.altervista.org/9sg_south_river_priv.html · Nota
• http://vupen.com/english/advisories/2009/2994 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53885 · Nota
• http://securityfocus.com/archive/1/507323/100/0/threaded · Nota