PT-2007-3401 · Eiqnetworks · Eiqnetworks Enterprise Security Analyzer

Published 2007-04-18 · Updated 2018-10-16 · CVE-2007-2059

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions eIQnetworks Enterprise Security Analyzer (ESA) version 2.5

Description The issue concerns multiple buffer overflows in the ESA protocol implementation. Remote attackers can execute arbitrary code by providing a long parameter to specific commands, including the DELETESEARCHFOLDER, DELTASK, HMGR CHECKHOSTSCSV, TASKUPDATEDUSER, VERIFYUSERKEY, or VERIFYPWD command.

Recommendations For eIQnetworks Enterprise Security Analyzer (ESA) version 2.5, consider restricting access to the vulnerable commands until a patch is available. As a temporary workaround, avoid using long parameters with the affected commands.

Exploit

Fix

Related Identifiers

CVE-2007-2059

Affected Products

Eiqnetworks Enterprise Security Analyzer

References · 7

• 🔥 https://exploit-db.com/exploits/29850 · Exploit
• http://secunia.com/advisories/24881 · Vendor Advisory
• http://infigo.hr/en/in_focus/advisories/INFIGO-2007-04-05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2059 · Security Note
• http://vupen.com/english/advisories/2007/1380 · Note
• http://securityfocus.com/archive/1/465488/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33646 · Note