PT-2017-12225 · Actian · Actian Pervasive Psql+1
Publicado
2017-07-31
·
Atualizado
2019-10-03
·
CVE-2017-11757
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Actian Pervasive PSQL version 12.10
Actian Zen version 13
Description
The issue is a heap-based buffer overflow that allows remote attackers to execute arbitrary code via crafted traffic to TCP port 1583. This occurs after the Server-Client encryption-key exchange. The problem stems from an integer underflow that results in a zero-byte allocation. The
srvLnaConnectMP1 function is affected.Recommendations
For Actian Pervasive PSQL version 12.10, update to a version that fixes the integer underflow issue to prevent the heap-based buffer overflow.
For Actian Zen version 13, update to a version that fixes the integer underflow issue to prevent the heap-based buffer overflow.
As a temporary workaround, consider restricting access to TCP port 1583 to minimize the risk of exploitation.
Exploit
Correção
Integer Underflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Actian Pervasive Psql
Actian Zen