PT-2011-3283 · Dell · Dell Kace K2000 System Deployment Appliance

Cody Green · Publicado 2011-04-10 · Atualizado 2017-08-17 · CVE-2011-1672

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell KACE K2000 Systems Deployment Appliance versions 3.3.36822 and earlier

Description The issue allows remote attackers to obtain sensitive information by reading certain files. Specifically, attackers can read the unattend.xml or sysprep.inf file, which may contain sensitive data such as passwords.

Recommendations For Dell KACE K2000 Systems Deployment Appliance versions 3.3.36822 and earlier, consider restricting access to the peinst CIFS share as a temporary workaround until a patch is available. Additionally, limit access to sensitive files such as unattend.xml and sysprep.inf to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-1672

Produtos afetados

Dell Kace K2000 System Deployment Appliance

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-1672 · Nota de Segurança
• http://kace.com/support/kb/index.php?action=artikel&cat=1&id=1104 · Aviso do Fabricante
• http://securityfocus.com/bid/47172 · Nota
• http://vupen.com/english/advisories/2011/0883 · Nota
• http://kb.cert.org/vuls/id/598700 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66630 · Nota