PT-2017-3510 · Flexense · Disksavvy+3

Anurag Srivastava + 2 · Published 2017-08-25 · Updated 2018-02-13 · CVE-2017-13696

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DiskPulse versions 9.9.16 and earlier DiskSavvy versions 9.9.14 and earlier DupScout versions 9.9.14 and earlier SyncBreeze versions 9.9.16 and earlier

Description The issue is caused by a buffer overflow in the web server component of the affected software. This can be exploited by a remote attacker using a specially crafted HTTP GET request, allowing them to gain access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability is due to improper handling and sanitization of incoming requests.

Recommendations For DiskPulse version 9.9.16 and earlier, update to a version that fixes the buffer overflow vulnerability. For DiskSavvy version 9.9.14 and earlier, update to a version that fixes the buffer overflow vulnerability. For DupScout version 9.9.14 and earlier, update to a version that fixes the buffer overflow vulnerability. For SyncBreeze version 9.9.16 and earlier, update to a version that fixes the buffer overflow vulnerability. As a temporary workaround, consider restricting access to the web server component until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2018-00361

CVE-2017-13696

Affected Products

Diskpulse

Disksavvy

Dupscout

Syncbreeze

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dupscts_bof.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb · Exploit
• 🔥 https://exploit-db.com/exploits/42560 · Exploit
• 🔥 https://exploit-db.com/exploits/42558 · Exploit
• 🔥 https://exploit-db.com/exploits/42557 · Exploit
• 🔥 https://exploit-db.com/exploits/42559 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-13696 · Security Note
• https://osv.dev/vulnerability/CVE-2017-13696 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00361 · Security Note
• https://rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_get · Note