PT-2015-7490 · Mobatek · Mobaxterm

Bryan Rhodes + 3 · Published 2015-11-04 · Updated 2015-11-04 · CVE-2015-7244

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MobaXterm versions prior to 8.3

Description The default configuration of the server in MobaXterm has a disabled Access Control setting, which does not require authentication for X11 connections. This allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.

Recommendations For versions prior to 8.3, enable the Access Control setting to require authentication for X11 connections.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-7244

Affected Products

Mobaxterm

References · 4

• http://blog.mobatek.net/post/mobaxterm-new-release-8.3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7244 · Security Note
• http://securifera.com/advisories/cve-2015-7244 · Note
• http://kb.cert.org/vuls/id/316888 · Note