PT-2015-7420 · Borland+1 · Borland Accurev+1

Rgod · Published 2015-09-02 · Updated 2019-06-26 · CVE-2015-6946

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Borland AccuRev (affected versions not specified)

Description The issue concerns multiple stack-based buffer overflows in the Reprise License Manager service. These overflows can be triggered by remote attackers through specific parameters, including the actserver and akey parameters to the activate doit function, as well as the licfile parameter to the service startup doit functionality. This allows attackers to execute arbitrary code.

Recommendations For the activate doit function, consider disabling the use of the actserver and akey parameters until a patch is available. Restrict access to the service startup doit functionality to minimize the risk of exploitation through the licfile parameter. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-6946

ZDI-15-412

ZDI-15-414

ZDI-15-416

Affected Products

Borland Accurev

Reprise License Manager

References · 8

• 🔥 https://redr2e.com/cve-to-poc-cve-2015-6946 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-15-416 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6946 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-412 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-414 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-15-412 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-414 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-416 · Note