PT-2017-17119 · Microsoft · Azure Data Expert Ultimate

Peter Baris · Publicado 2017-03-10 · Atualizado 2017-03-15 · CVE-2017-6506

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure Data Expert Ultimate version 2.2.16

Description The issue is related to a buffer overflow in the SMTP verification function, which can lead to remote code execution. This occurs when a crafted SMTP daemon sends a long "Service ready" string, specifically the 220 response code.

Recommendations For Azure Data Expert Ultimate version 2.2.16, consider disabling the SMTP verification function until a patch is available to prevent potential remote code execution. Restrict access to the SMTP daemon to minimize the risk of exploitation. Avoid using the SMTP verification function with untrusted or unknown SMTP daemons until the issue is resolved.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-6506

Produtos afetados

Azure Data Expert Ultimate

Referências · 5

• 🔥 https://exploit-db.com/exploits/41545 · Exploit
• 🔥 http://packetstormsecurity.com/files/141502/Azure-Data-Expert-Ultimate-2.2.16-Buffer-Overflow.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-6506 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6506 · Nota de Segurança
• http://securityfocus.com/bid/96824 · Nota