PT-2014-4286 · Dell · Dell Kace K1000

Publicado 2014-01-26 · Atualizado 2018-08-13 · CVE-2014-1671

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dell KACE K1000 version 5.4.76847 and possibly earlier

Description The issue allows remote attackers or remote authenticated users to execute arbitrary SQL commands. This can be achieved via several means, including the macAddress element in a getUploadPath or getKBot SOAP request to "service/kbot service.php", the ID parameter to "userui/advisory detail.php" or "userui/ticket.php", and the ORDER[] parameter to "userui/ticket list.php".

Recommendations For Dell KACE K1000 version 5.4.76847 and possibly earlier, consider restricting access to the service/kbot service.php, userui/advisory detail.php, userui/ticket.php, and userui/ticket list.php endpoints until a patch is available. As a temporary workaround, avoid using the macAddress element in getUploadPath or getKBot SOAP requests, and restrict the use of the ID parameter in userui/advisory detail.php and userui/ticket.php, as well as the ORDER[] parameter in userui/ticket list.php. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-1671

Produtos afetados

Dell Kace K1000

Referências · 7

• 🔥 https://exploit-db.com/exploits/39057 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90592 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1671 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1671 · Nota
• http://securityfocus.com/bid/65029 · Nota
• http://secunia.com/advisories/56396 · Aviso do Fabricante
• http://baesystemsdetica.com.au/Research/Advisories/Dell-KACE-K1000-SQL-Injection-%28DS-2014-001%29 · Nota