CVE-2002-0066

Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control, which allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://razor.bindview.com/publish/advisories/adv_FunkProxy.html	Patch Vendor Advisory
http://www.iss.net/security_center/static/8793.php
http://www.securityfocus.com/bid/4460

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:funk_software:funk_software_proxy:3.0:::::::*
	cpe:2.3:a:funk_software:funk_software_proxy:3.09:::::::*
	cpe:2.3:a:bindview:netrc:1.0:::::::*
	cpe:2.3:a:bindview:netrc:3.06:::::::*
	cpe:2.3:a:funk_software:funk_software_proxy:3.06:::::::*

Information

Published : 2002-04-21 21:00

Updated : 2008-09-10 12:11

NVD link : CVE-2002-0066

Mitre link : CVE-2002-0066

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

funk_software

funk_software_proxy

bindview

netrc

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://razor.bindview.com/publish/advisories/adv_FunkProxy.html", "name": "20020408 Unauthorized remote control access to systems running Funk Software's Proxy v3.x", "tags": ["Patch", "Vendor Advisory"], "refsource": "BINDVIEW"}, {"url": "http://www.iss.net/security_center/static/8793.php", "name": "funk-proxy-named-pipe(8793)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/bid/4460", "name": "4460", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control, which allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2002-0066", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2002-04-22T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:funk_software:funk_software_proxy:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:funk_software:funk_software_proxy:3.09:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:bindview:netrc:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:bindview:netrc:3.06:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:funk_software:funk_software_proxy:3.06:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-10T19:11Z"}