PT-2011-2388 · Objectivity · Objectivity/Db

Jeremy Brown · Published 2011-01-18 · Updated 2017-08-17 · CVE-2011-0489

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Objectivity/DB version 10.0

Description The issue allows remote attackers to modify data, obtain sensitive information, or cause a denial of service. This is possible because the server components do not require authentication for administrative commands. Attackers can send requests over TCP to the Lock Server or the Advanced Multithreaded Server. Examples of commands that can be sent include those ordinarily used by the ookillls and oostopams applications.

Recommendations For Objectivity/DB version 10.0, consider implementing authentication for administrative commands to prevent unauthorized access. As a temporary workaround, restrict access to the Lock Server and the Advanced Multithreaded Server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-0489

Affected Products

Objectivity/Db

References · 9

• 🔥 http://exploit-db.com/exploits/15988 · Exploit
• 🔥 https://exploit-db.com/exploits/15988 · Exploit
• http://secunia.com/advisories/42901 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0489 · Security Note
• http://osvdb.org/70424 · Note
• http://securityfocus.com/bid/45803 · Note
• http://kb.cert.org/vuls/id/782567 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64699 · Note