PT-2023-2330 · Rocket · Unidata+1

Ron Bowes · Publicado 2023-03-29 · Atualizado 2023-04-06 · CVE-2023-28505

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rocket Software UniData versions prior to 8.2.4 build 3003 Rocket Software UniVerse versions prior to 11.3.5 build 1001 Rocket Software UniVerse versions prior to 12.2.1 build 2002

Description The issue is related to a buffer overflow in an API function of Rocket Software UniData and UniVerse, where a string is copied into a caller-provided buffer without checking the length. This can be exploited by a remote attacker with a valid login, potentially allowing the execution of arbitrary code.

Recommendations For Rocket Software UniData versions prior to 8.2.4 build 3003, update to version 8.2.4 build 3003 or later. For Rocket Software UniVerse versions prior to 11.3.5 build 1001, update to version 11.3.5 build 1001 or later. For Rocket Software UniVerse versions prior to 12.2.1 build 2002, update to version 12.2.1 build 2002 or later. As a temporary workaround, consider restricting access to the vulnerable API function until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

BDU:2023-02095

CVE-2023-28505

Produtos afetados

Unidata

Universe

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28505 · Nota de Segurança
• https://t.me/cibsecurity/61143 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02095 · Nota de Segurança
• https://rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed · Nota
• https://rbc.rocketsoftware.com · Nota
• https://osv.dev/vulnerability/CVE-2023-28505 · Aviso do Fabricante