PT-2010-5148 · Ibm · Ibm Omnifind Enterprise Edition

Fatih Kilic · Publicado 2010-11-12 · Atualizado 2018-10-10 · CVE-2010-3894

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM OmniFind Enterprise Edition versions prior to 8.5 FP6

Description The issue is related to a stack-based buffer overflow in the Java com ibm es oss CryptionNative ESEncrypt function. This function is located in the /opt/IBM/es/lib/libffq.cryptionjni.so library, which is part of the login form in the administration interface. The overflow can be triggered by a remote attacker using a long password, potentially allowing the execution of arbitrary code.

Recommendations For IBM OmniFind Enterprise Edition versions prior to 8.5 FP6, update to version 8.5 FP6 or later to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-3894

Produtos afetados

Ibm Omnifind Enterprise Edition

Referências · 8

• 🔥 https://exploit-db.com/exploits/15474 · Exploit
• 🔥 http://exploit-db.com/exploits/15474 · Exploit
• 🔥 http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt · Exploit
• http://vupen.com/english/advisories/2010/2933 · Nota
• http://securityfocus.com/archive/1/514688/100/0/threaded · Nota
• http://osvdb.org/69079 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3894 · Nota de Segurança
• http://securityfocus.com/bid/44740 · Nota