PT-2017-3512 · Quest · Quest Netvault Backup
Rgod
·
Publicado
2017-12-06
·
Atualizado
2019-10-09
·
CVE-2018-1161
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Quest NetVault Backup version 11.2.0.13
Description
This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The specific flaw exists within the
nvwsworker.exe file. When parsing the boundary header of a multipart request, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this issue to execute code under the context of SYSTEM.Recommendations
For Quest NetVault Backup version 11.2.0.13, consider disabling the
nvwsworker.exe process until a patch is available to prevent exploitation. Restrict access to the vulnerable service to minimize the risk of exploitation. Avoid using the multipart request boundary header until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.Correção
Stack Overflow
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Quest Netvault Backup