CVE-2008-2468

Multiple buffer overflows in the QIP Server Service (aka qipsrvr.exe) in LANDesk Management Suite, Security Suite, and Server Manager 8.8 and earlier allow remote attackers to execute arbitrary code via a crafted heal request, related to the StringToMap and StringSize arguments.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://community.landesk.com/support/docs/DOC-3276	Patch
http://www.securityfocus.com/bid/31193	Patch
http://dvlabs.tippingpoint.com/advisory/TPTI-08-06
http://secunia.com/advisories/31888
http://www.securitytracker.com/id?1020888
http://www.kb.cert.org/vuls/id/538011	US Government Resource
http://securityreason.com/securityalert/4269
http://www.vupen.com/english/advisories/2008/2588
https://exchange.xforce.ibmcloud.com/vulnerabilities/45154
http://www.securityfocus.com/archive/1/496369/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:landesk:landesk_security_suite:8.7:::::::*
	cpe:2.3:a:landesk:landesk_management_suite::::::::
	cpe:2.3:a:landesk:landesk_management_suite:8.7:::::::*
	cpe:2.3:a:landesk:landesk_server_manager:8.7:::::::*
	cpe:2.3:a:landesk:landesk_security_suite::::::::
	cpe:2.3:a:landesk:landesk_server_manager::::::::

Information

Published : 2008-09-18 08:04

Updated : 2018-10-11 13:41

NVD link : CVE-2008-2468

Mitre link : CVE-2008-2468

JSON object : View

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Advertisement

Products Affected

landesk

landesk_management_suite
landesk_server_manager
landesk_security_suite

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://community.landesk.com/support/docs/DOC-3276", "name": "http://community.landesk.com/support/docs/DOC-3276", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/31193", "name": "31193", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://dvlabs.tippingpoint.com/advisory/TPTI-08-06", "name": "http://dvlabs.tippingpoint.com/advisory/TPTI-08-06", "tags": [], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/31888", "name": "31888", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.securitytracker.com/id?1020888", "name": "1020888", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.kb.cert.org/vuls/id/538011", "name": "VU#538011", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://securityreason.com/securityalert/4269", "name": "4269", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2008/2588", "name": "ADV-2008-2588", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45154", "name": "landesk-qip-bo(45154)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/496369/100/0/threaded", "name": "20080915 TPTI-08-06: Landesk QIP Server Service Heal Packet Buffer Overflow", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple buffer overflows in the QIP Server Service (aka qipsrvr.exe) in LANDesk Management Suite, Security Suite, and Server Manager 8.8 and earlier allow remote attackers to execute arbitrary code via a crafted heal request, related to the StringToMap and StringSize arguments."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-119"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-2468", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2008-09-18T15:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:landesk:landesk_security_suite:8.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:landesk:landesk_management_suite:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "8.8"}, {"cpe23Uri": "cpe:2.3:a:landesk:landesk_management_suite:8.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:landesk:landesk_server_manager:8.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:landesk:landesk_security_suite:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "8.8"}, {"cpe23Uri": "cpe:2.3:a:landesk:landesk_server_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "8.8"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-11T20:41Z"}