PT-2017-6723 · Unisys · Scp-Firmware+2

Publicado 2017-02-03 · Atualizado 2017-03-14 · CVE-2015-4049

Positive Technologies (AI Summary)

CVSS v2.0

5.6

Média

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE versions prior to 40.0IC4 Build 270

Description The issue allows remote authenticated users to cause a denial of service, resulting in data corruption or system crash. This occurs when using program operators during EPSILON (level 5) based codefiles at peak memory usage, triggering CPM stack corruption.

Recommendations For Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE versions prior to 40.0IC4 Build 270, update to MCP-FIRMWARE version 40.0IC4 Build 270 or later to resolve the issue. As a temporary workaround, consider restricting peak memory usage during EPSILON (level 5) based codefile operations to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-4049

Produtos afetados

Fs600

Scp-Firmware

Unisys Libra

Referências · 2

• http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-4049 · Nota de Segurança