PT-2015-1275 · Infoblox · Infoblox Netmri

Publicado 2015-02-20 · Atualizado 2016-11-30 · CVE-2015-2033

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Infoblox Network Automation NetMRI versions prior to NETMRI-23483

Description The issue is related to a flaw in the authentication procedure of the NetMRI network monitoring program in the Anyterm Daemon. This flaw allows remote attackers to execute arbitrary commands with root privileges via crafted terminal/anyterm-module requests. Exploitation of this issue may enable a remote attacker to execute arbitrary code using specially formed requests.

Recommendations For versions prior to NETMRI-23483, update to a version that includes the fix for this issue, specifically NETMRI-23483 or later. As a temporary workaround, consider restricting access to the Anyterm Daemon to minimize the risk of exploitation. Avoid using the Anyterm Daemon until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2015-10305

CVE-2015-2033

Produtos afetados

Infoblox Netmri

Referências · 6

• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2033 · Nota
• https://support.infoblox.com/app/answers/detail/a_id/3666/kw/NETMRI-23483 · Nota
• http://unsecurityresearch.com/index.php?option=com_content&view=article&id=46&Itemid=53 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2033 · Nota de Segurança
• http://securityfocus.com/bid/73423 · Nota
• https://bdu.fstec.ru/vul/2015-10305 · Nota de Segurança