PT-2017-17200 · Yes · Yesmaxtotal+2

Publicado 2017-09-07 · Atualizado 2019-10-09 · CVE-2017-6631

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions YesMaxTotal (affected versions not specified) YesMax HD (affected versions not specified) YesQuattro STB (affected versions not specified)

Description A vulnerability in the HTTP remote procedure call (RPC) service could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue exists because the firmware fails to handle certain XML values passed to the HTTP RPC service. An attacker could exploit this by submitting a malformed request, causing the device to restart and resulting in a DoS condition.

Recommendations For YesMaxTotal, update to the latest firmware provided by Yes to address the vulnerability. For YesMax HD, update to the latest firmware provided by Yes to address the vulnerability. For YesQuattro STB, update to the latest firmware provided by Yes to address the vulnerability.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2017-6631

Produtos afetados

Yesmax Hd

Yesmaxtotal

Yesquattro Stb

Referências · 3

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-stb · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6631 · Nota de Segurança
• http://securityfocus.com/bid/100672 · Nota