PT-2015-3919 · Cybozu · Cybozu Remote Service Manager

Publicado 2015-02-01 · Atualizado 2015-02-02 · CVE-2014-7266

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cybozu Remote Service Manager versions 2.3.0 and earlier Cybozu Remote Service Manager versions 3.x through 3.1.2

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by triggering colliding hash-table keys. This problem exists due to an incomplete fix for a previous issue.

Recommendations For Cybozu Remote Service Manager versions 2.3.0 and earlier, update to a version later than 2.3.0 to resolve the issue. For Cybozu Remote Service Manager versions 3.x through 3.1.2, update to a version later than 3.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the service to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2014-7266

Produtos afetados

Cybozu Remote Service Manager

Referências · 4

• https://cs.cybozu.co.jp/2015/001245.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-7266 · Nota de Segurança
• http://jvn.jp/en/jp/JVN13566542/index.html · Aviso do Fabricante
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000001 · Aviso do Fabricante