PT-2019-15301 · Advantech · Advantech Diaganywhere Server

Z0Mb1E · Publicado 2019-12-13 · Atualizado 2020-10-22 · CVE-2019-18257

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech DiagAnywhere Server versions 3.07.11 and prior

Description The issue is related to multiple stack-based buffer overflow vulnerabilities in the file transfer service of Advantech DiagAnywhere Server. These vulnerabilities could allow an unauthenticated attacker to execute arbitrary code with the privileges of the user running the server. The vulnerabilities exist in various functions, including FOLDER CREATE, FILE OPEN RO, FOLDER REMOVE, FILE CREATE, and SET CURR DIR.

Recommendations For Advantech DiagAnywhere Server versions 3.07.11 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

CVE-2019-18257

ZDI-19-1017

ZDI-19-1018

ZDI-19-1019

ZDI-19-1020

ZDI-19-1021

Produtos afetados

Advantech Diaganywhere Server

Referências · 8

• https://zerodayinitiative.com/advisories/ZDI-19-1019 · Nota de Segurança
• https://us-cert.gov/ics/advisories/icsa-19-346-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-18257 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-1018 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-1017 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-1020 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18257 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-19-1021 · Nota de Segurança