PT-2012-3927 · Emc · Emc Networker

Publicado 2012-09-04 · Atualizado 2013-03-06 · CVE-2012-2288

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC NetWorker versions 7.6.3 through 7.6.4 EMC NetWorker versions 8.0 through 8.0.0.0

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in a message. This is due to a format string vulnerability in the nsrd RPC service.

Recommendations For EMC NetWorker versions 7.6.3 through 7.6.4, update to version 7.6.4.1 or later. For EMC NetWorker versions 8.0 through 8.0.0.0, update to version 8.0.0.1 or later.

Exploit

Correção

RCE

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2012-2288

Produtos afetados

Emc Networker

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/emc/networker_format_string.rb · Exploit
• 🔥 https://exploit-db.com/exploits/22525 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2288 · Nota
• http://securityfocus.com/bid/55330 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2288 · Nota de Segurança
• http://securitytracker.com/id?1027459 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2012-08/0219.html · Nota