PT-2002-2883 · Working Resources · Badblue Enterprise Edition

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2170

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Working Resources Inc. BadBlue Enterprise Edition versions 1.7 through 1.74

Description: The issue allows remote attackers to execute arbitrary code by accessing the dir.hts page on the localhost and adding an entire hard drive to be shared, due to insufficient authentication. This is possible because the software attempts to restrict administrator actions to the IP address of the local host but does not provide additional authentication.

Recommendations: For versions 1.7 through 1.74, consider restricting access to the dir.hts page to minimize the risk of exploitation. As a temporary workaround, limit the ability to add entire hard drives to be shared until a more robust authentication mechanism is implemented.

Exploit

Fix

Related Identifiers

CVE-2002-2170

Affected Products

Badblue Enterprise Edition

References · 6

• 🔥 https://exploit-db.com/exploits/21630 · Exploit
• 🔥 http://securityfocus.com/bid/5276 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2170 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2170 · Note
• http://iss.net/security_center/static/9642.php · Note
• http://online.securityfocus.com/archive/1/283418 · Note