PT-2006-6001 · Microsoft · Dynamics Gp

Published 2006-12-31 · Updated 2017-07-20 · CVE-2006-5266

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics GP versions 9.0 and earlier

Description The issue allows remote attackers to execute arbitrary code via crafted messages to specific components. This can be achieved by sending a crafted Distributed Process Manager (DPM) message to the DPM component, or by sending a long string or long IP address in a Distributed Process Server (DPS) message to either the DPM or DPS component.

Recommendations For Microsoft Dynamics GP versions 9.0 and earlier, consider restricting access to the DPM and DPS components until a fix is available. As a temporary workaround, avoid using long strings or IP addresses in DPS messages to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-5266

Affected Products

Dynamics Gp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-5266 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25840 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25841 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25842 · Note
• http://securityfocus.com/bid/29991 · Note