PT-2015-3919 · Cybozu · Cybozu Remote Service Manager

Published 2015-02-01 · Updated 2015-02-02 · CVE-2014-7266

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cybozu Remote Service Manager versions 2.3.0 and earlier Cybozu Remote Service Manager versions 3.x through 3.1.2

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by triggering colliding hash-table keys. This problem exists due to an incomplete fix for a previous issue.

Recommendations For Cybozu Remote Service Manager versions 2.3.0 and earlier, update to a version later than 2.3.0 to resolve the issue. For Cybozu Remote Service Manager versions 3.x through 3.1.2, update to a version later than 3.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the service to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-7266

Affected Products

Cybozu Remote Service Manager

References · 4

• https://cs.cybozu.co.jp/2015/001245.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7266 · Security Note
• http://jvn.jp/en/jp/JVN13566542/index.html · Vendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000001 · Vendor Advisory