PT-2014-3702 · Attachmate · Attachmate Reflection Ftp Client

Rgod · Publicado 2014-08-12 · Atualizado 2015-02-09 · CVE-2014-0603

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Attachmate Reflection FTP Client versions prior to 14.1.429

Description The issue allows remote attackers to cause a denial of service and execute arbitrary code via vectors related to the GetGlobalSettings or GetSiteProperties3 methods, which triggers a dereference of an arbitrary memory address.

Recommendations For versions prior to 14.1.429, update to version 14.1.429 or later to resolve the issue. As a temporary workaround, consider disabling the GetGlobalSettings and GetSiteProperties3 methods until a patch is available. Restrict access to the rftpcom.dll ActiveX control to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-0603

ZDI-14-288

ZDI-14-291

Produtos afetados

Attachmate Reflection Ftp Client

Referências · 6

• https://zerodayinitiative.com/advisories/ZDI-14-288 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-0603 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-14-288 · Nota
• http://support.attachmate.com/techdocs/2501.html · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-14-291 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-14-291 · Nota