PT-2017-17119 · Microsoft · Azure Data Expert Ultimate

Peter Baris · Published 2017-03-10 · Updated 2017-03-15 · CVE-2017-6506

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure Data Expert Ultimate version 2.2.16

Description The issue is related to a buffer overflow in the SMTP verification function, which can lead to remote code execution. This occurs when a crafted SMTP daemon sends a long "Service ready" string, specifically the 220 response code.

Recommendations For Azure Data Expert Ultimate version 2.2.16, consider disabling the SMTP verification function until a patch is available to prevent potential remote code execution. Restrict access to the SMTP daemon to minimize the risk of exploitation. Avoid using the SMTP verification function with untrusted or unknown SMTP daemons until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-6506

Affected Products

Azure Data Expert Ultimate

References · 5

• 🔥 https://exploit-db.com/exploits/41545 · Exploit
• 🔥 http://packetstormsecurity.com/files/141502/Azure-Data-Expert-Ultimate-2.2.16-Buffer-Overflow.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-6506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6506 · Security Note
• http://securityfocus.com/bid/96824 · Note