CVE-2007-2343

Stack-based buffer overflow in the TFTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via crafted request packets that contain long file names.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506	Vendor Advisory
http://www.enterasys.com/pub/NetSight/Patches/SP1/NetSight_SP1.pdf	Patch
http://www.securitytracker.com/id?1017876
http://secunia.com/advisories/24764	Exploit Vendor Advisory
http://osvdb.org/34627
http://www.vupen.com/english/advisories/2007/1271

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:enterasys:netsight_console::::::::
	cpe:2.3:a:enterasys:netsight_inventory_manager::::::::

Information

Published : 2007-04-27 10:19

Updated : 2011-03-07 18:54

NVD link : CVE-2007-2343

Mitre link : CVE-2007-2343

JSON object : View

CWE

NVD-CWE-Other

Products Affected

enterasys

netsight_console
netsight_inventory_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506", "name": "20070404 Enterasys Networks Multiple NetSight Products Multiple Vulnerabilities", "tags": ["Vendor Advisory"], "refsource": "IDEFENSE"}, {"url": "http://www.enterasys.com/pub/NetSight/Patches/SP1/NetSight_SP1.pdf", "name": "http://www.enterasys.com/pub/NetSight/Patches/SP1/NetSight_SP1.pdf", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.securitytracker.com/id?1017876", "name": "1017876", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/24764", "name": "24764", "tags": ["Exploit", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/34627", "name": "34627", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/1271", "name": "ADV-2007-1271", "tags": [], "refsource": "VUPEN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Stack-based buffer overflow in the TFTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via crafted request packets that contain long file names."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-2343", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-04-27T17:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:enterasys:netsight_console:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.1"}, {"cpe23Uri": "cpe:2.3:a:enterasys:netsight_inventory_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2011-03-08T02:54Z"}

7.5 /10