PT-2017-2749 · Nokia · Noviware

François Goichon · Publicado 2017-05-11 · Atualizado 2017-08-29 · CVE-2017-12787

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NoviWare versions through NW400.2.6

Description The issue is caused by a stack-based buffer overflow in the ACL component of the NoviWare operating system. This can be exploited by a remote attacker using specially crafted network packets containing operating system commands, potentially allowing the execution of arbitrary code when ACL changes are applied. The vulnerability can be leveraged by remote, unauthenticated attackers to gain privileged code execution on the switch.

Recommendations For NoviWare versions through NW400.2.6, consider restricting access to the ACL modification functionality until a patch is available, and avoid using the novi process manager daemon service for applying ACL changes to prevent potential exploitation. As a temporary workaround, limit the exposure of the network interface of the novi process manager daemon service to minimize the risk of remote, unauthenticated attacks.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2017-01997

CVE-2017-12787

Produtos afetados

Noviware

Referências · 4

• 🔥 https://exploit-db.com/exploits/42518 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-12787 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12787 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-01997 · Nota de Segurança