PT-2010-2929 · Ca · Ca Xosoft

Publicado 2010-04-06 · Atualizado 2018-10-10 · CVE-2010-1223

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CA XOsoft versions r12.0 through r12.5

Description The issue allows remote attackers to execute arbitrary code. This can be achieved via a malformed request to the "ws man/xosoapapi.asmx" SOAP endpoint or by sending a long string to the "entry point.aspx" service.

Recommendations For versions r12.0 through r12.5, consider disabling the xosoapapi.asmx and entry point.aspx services until a patch is available to prevent remote code execution. Restrict access to these services to minimize the risk of exploitation. Avoid using the xosoapapi.asmx endpoint and the entry point.aspx service until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-1223

ZDI-10-065

ZDI-10-066

Produtos afetados

Ca Xosoft

Referências · 10

• http://securityfocus.com/archive/1/510564/100/0/threaded · Nota
• http://securityfocus.com/bid/39238 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-1223 · Nota de Segurança
• http://securityfocus.com/archive/1/510565/100/0/threaded · Nota
• http://zerodayinitiative.com/advisories/ZDI-10-066 · Nota
• https://zerodayinitiative.com/advisories/ZDI-10-065 · Nota de Segurança
• http://securityfocus.com/archive/1/510567/100/0/threaded · Nota
• https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=232869 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-10-066 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-10-065 · Nota