PT-2016-7498 · Moxa · Softcms

Gu Ziqiang + 1 · Published 2016-11-23 · Updated 2017-02-17 · CVE-2016-8360

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa SoftCMS versions prior to 1.6

Description A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server, allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code.

Recommendations For versions prior to 1.6, update to version 1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ASP Webserver to minimize the risk of exploitation. Avoid using specially crafted URL requests in the affected ASP Webserver until the issue is resolved.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2016-8360

ZDI-16-615

Affected Products

Softcms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-8360 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-615 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8360 · Vendor Advisory
• http://securityfocus.com/bid/94394 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02 · Note