PT-2019-1399 · Wibu Systems · Wibukey Network Server Management

Publicado 2019-02-05 · Atualizado 2022-04-19 · CVE-2018-3991

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WibuKey Network Server Management version 6.40.2402.500

Description The issue is related to a heap overflow vulnerability in the WkbProgramLow function. This can be exploited by sending specially crafted TCP packets, potentially leading to remote code execution and denial of service. The vulnerability can be triggered by sending a malformed TCP packet to port 22347/TCP.

Recommendations For version 6.40.2402.500, consider restricting access to port 22347/TCP to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the WkbProgramLow function until the issue is resolved.

Exploit

Correção

Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-119

CWE-787

Identificadores relacionados

BDU:2019-00771

CVE-2018-3991

Produtos afetados

Wibukey Network Server Management

Referências · 10

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0659 · Exploit
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0657 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-760124.pdf · Nota
• http://securityfocus.com/bid/107005 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf · Nota
• https://bdu.fstec.ru/vul/2019-00771 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-3991 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3989 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-3991 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf · Nota