PT-2011-3825 · Iron Mountain · Iron Mountain Connected Backup

Publicado 2011-12-01 · Atualizado 2017-08-29 · CVE-2011-2397

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Iron Mountain Connected Backup version 8.4

Description The issue allows remote attackers to execute arbitrary code via a crafted request. This is achieved by triggering the use of a specific class to send request data to the System.getRunTime.exec method.

Recommendations For Iron Mountain Connected Backup version 8.4, consider disabling the LaunchCompoundFileAnalyzer class as a temporary workaround until a patch is available. Restrict access to the System.getRunTime.exec method to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-2397

ZDI-11-339

Produtos afetados

Iron Mountain Connected Backup

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-2397 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71602 · Nota
• http://zerodayinitiative.com/advisories/ZDI-11-339 · Nota
• https://zerodayinitiative.com/advisories/ZDI-11-339 · Nota de Segurança
• http://osvdb.org/77495 · Nota