PT-2013-4765 · Mongodb · Mongodb

Publicado 2013-10-01 · Atualizado 2013-10-02 · CVE-2013-3969

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MongoDB versions 2.4.0 through 2.4.4

Description The issue allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via an invalid RefDB object, resulting from an uninitialized pointer dereference and server crash in the find prototype in scripting/engine v8.h.

Recommendations For MongoDB versions 2.4.0 through 2.4.4, update to a version outside of this range to resolve the issue.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2013-3969

Produtos afetados

Mongodb

Referências · 8

• 🔥 https://exploit-db.com/exploits/38669 · Exploit
• http://mongodb.org/about/alerts · Aviso do Fabricante
• http://secunia.com/advisories/54170 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/07/30/10 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3969 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3969 · Nota de Segurança
• http://blog.scrt.ch/2013/06/04/mongodb-rce-by-databasespraying · Nota
• https://jira.mongodb.org/browse/SERVER-9878 · Nota