PT-2017-14711 · Flexense · Syncbreeze Enterprise

Wetw0Rk · Publicado 2017-12-03 · Atualizado 2017-12-20 · CVE-2017-17099

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flexense SyncBreeze Enterprise version 10.1.16

Description The issue is related to an unauthenticated SEH based Buffer Overflow in the HTTP server. It can be triggered by sending a GET request with an excessive length, allowing a malicious user to overwrite the SEH record and potentially execute a payload under the Windows SYSTEM account.

Recommendations For Flexense SyncBreeze Enterprise version 10.1.16, consider restricting access to the HTTP server until a patch is available. As a temporary workaround, limiting the length of incoming GET requests may help mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-17099

Produtos afetados

Syncbreeze Enterprise

Referências · 5

• 🔥 https://github.com/wetw0rk/Exploit-Development · Exploit
• 🔥 https://packetstormsecurity.com/files/144586/Sync-Breeze-Enterprise-10.1.16-SEH-Overflow.html · Exploit
• 🔥 https://exploit-db.com/exploits/42984 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17099 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17099 · Aviso do Fabricante