PT-2017-14308 · Flexense · Syncbreeze Enterprise

Filipe Xavier Oliveira · Published 2017-10-31 · Updated 2021-03-29 · CVE-2017-15950

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flexense SyncBreeze Enterprise version 10.1.16

Description The issue is related to a buffer overflow that can be exploited for arbitrary code execution. This is triggered by providing a long input into the Destination directory field, either within an XML document or through the use of passive mode.

Recommendations For Flexense SyncBreeze Enterprise version 10.1.16, avoid using long inputs in the Destination directory field until a fix is available. As a temporary workaround, consider restricting the length of inputs in this field to prevent potential exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-15950

Affected Products

Syncbreeze Enterprise

References · 5

• 🔥 https://exploit-db.com/exploits/49725 · Exploit
• https://osv.dev/vulnerability/CVE-2017-15950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15950 · Security Note
• http://packetstormsecurity.com/files/162008/SyncBreeze-10.1.16-Buffer-Overflow.html · Note
• http://seclists.org/fulldisclosure/2017/Oct/64 · Note