PT-2011-2388 · Objectivity · Objectivity/Db

Jeremy Brown · Publicado 2011-01-18 · Atualizado 2017-08-17 · CVE-2011-0489

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Objectivity/DB version 10.0

Description The issue allows remote attackers to modify data, obtain sensitive information, or cause a denial of service. This is possible because the server components do not require authentication for administrative commands. Attackers can send requests over TCP to the Lock Server or the Advanced Multithreaded Server. Examples of commands that can be sent include those ordinarily used by the ookillls and oostopams applications.

Recommendations For Objectivity/DB version 10.0, consider implementing authentication for administrative commands to prevent unauthorized access. As a temporary workaround, restrict access to the Lock Server and the Advanced Multithreaded Server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2011-0489

Produtos afetados

Objectivity/Db

Referências · 9

• 🔥 http://exploit-db.com/exploits/15988 · Exploit
• 🔥 https://exploit-db.com/exploits/15988 · Exploit
• http://secunia.com/advisories/42901 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0127 · Aviso do Fabricante
• http://osvdb.org/70424 · Nota
• http://securityfocus.com/bid/45803 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0489 · Nota de Segurança
• http://kb.cert.org/vuls/id/782567 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64699 · Nota