Vulnerability CVE-2017-17996

Vulnerability CVE-2017-17996

Published: 2018-02-06

Description:

A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Flexense SyncBreeze Enterprise 10.3.14 Buffer Overflow	ryantzj	03.02.2018

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
9/10	10/10	8/10

Exploit range	Attack complexity	Authentication
Remote	Low	Single time
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Flexense -> Syncbreeze

References:

http://seclists.org/fulldisclosure/2018/Feb/10

http://www.ryantzj.com/flexense-syncbreeze-entreprise-10314-buffer-overflow-seh-bypass.html

Copyright 2024, cxsecurity.com