PT-2013-5545 · Ibm · Ibm Forms Viewer

Andrea Micalizzi + 1 · Publicado 2013-12-10 · Atualizado 2017-08-29 · CVE-2013-5447

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Forms Viewer versions 4.x before 4.0.0.3 IBM Forms Viewer versions 8.x before 8.0.1.1

Description The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved via an XFDL form with a long fontname value.

Recommendations For versions 4.x before 4.0.0.3, update to version 4.0.0.3 or later. For versions 8.x before 8.0.1.1, update to version 8.0.1.1 or later.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2013-5447

ZDI-13-274

Produtos afetados

Ibm Forms Viewer

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ibm_forms_viewer_fontname.rb · Exploit
• 🔥 http://exploit-db.com/exploits/30789 · Exploit
• 🔥 https://exploit-db.com/exploits/30789 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-13-274 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21657500 · Aviso do Fabricante
• http://packetstormsecurity.com/files/124658 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87911 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1LO78184 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-13-274 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5447 · Nota de Segurança