Vulnerability CVE-2014-7249


Published: 2014-12-19

Description:
Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 9924SP, CentreCOM 9924T/4SP, Rapier 48i, and SwitchBlade4000 with firmware before 2.9.1-21 allows remote attackers to execute arbitrary code via a crafted HTTP POST request.

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

Vendor: Alliedtelesis
Product: At-9924ts firmware 
Version: 2.9.1-20;
Product: At-8648t/2sp firmware 
Version: 2.9.1-20;
Product: Ar745 firmware 
Version: 2.9.1-20;
Product: Centrecom ar550s firmware 
Version: 2.9.1-20;
Product: Centrecom 8948xl firmware 
Version: 2.9.1-20;
Product: At-8848 firmware 
Version: 2.9.1-20;
Product: Ar750s firmware 
Version: 2.9.1-20;
Product: Ar440s firmware 
Version: 2.9.1-20;
Product: Rapier 48i firmware 
Version: 2.9.1-20;
Product: Centrecom 9924t/4sp firmware 
Version: 2.9.1-20;
Product: At-9924t firmware 
Version: 2.9.1-20;
Product: At-8624t/2m firmware 
Version: 2.9.1-20;
Product: Ar442s firmware 
Version: 2.9.1-20;
Product: Centrecom ar450s firmware 
Version: 2.9.1-20;
Product: Centrecom 8700sl firmware 
Version: 2.9.1-20;
Product: At-8748xl firmware 
Version: 2.9.1-20;
Product: Ar750s-dp firmware 
Version: 2.9.1-20;
Product: Centrecom ar570s firmware 
Version: 2.9.1-20;
Product: Centrecom 9924sp firmware 
Version: 2.9.1-20;
Product: At-9816gb firmware 
Version: 2.9.1-20;
Product: At-8624poe firmware 
Version: 2.9.1-20;
Product: Ar441s firmware 
Version: 2.9.1-20;
Product: Switchblade4000 firmware 
Version: 2.9.1-20;
Product: Centrecom ar415s firmware 
Version: 2.9.1-20;
Product: Rapier 48i 
Product: Centrecom ar415s 
Product: At-9924t 
Product: At-8624t/2m 
Product: Centrecom ar550s 
Product: Centrecom 8948xl 
Product: At-8748xl 
Product: Centrecom ar8700sl 
Product: Centrecom 9924t/4sp 
Product: At-9816gb 
Product: At-8624poe 
Product: Switchblade4000 
Product: Centrecom ar450s 
Product: At-9924ts 
Product: At-8648t/2sp 
Product: Centrecom ar570s 
Product: Centrecom 9924sp 
Product: At-8848 
Product: Ar750s-dp 
Product: Ar440s 
Product: Ar442s 
Product: Ar750s 
Product: Ar441s 
Product: Ar745 

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://www.allied-telesis.co.jp/support/list/faq/vuls/20141111aen.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000132
http://jvn.jp/en/jp/JVN22440986/index.html

Copyright 2018, cxsecurity.com

 

Back to Top