CVE-2009-0043

The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access, which allows remote attackers to execute arbitrary commands via unspecified vectors.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/33161	Patch
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/07.aspx	Vendor Advisory
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=196148	Patch
http://securityreason.com/securityalert/4887
http://www.vupen.com/english/advisories/2009/0053
http://www.securityfocus.com/archive/1/499857/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ca:service_level_management:3.5:::::::*
	cpe:2.3:a:ca:service_metric_analysis:r11.1:sp1::::::
	cpe:2.3:a:ca:service_metric_analysis:r11.0:::::::*
	cpe:2.3:a:ca:service_metric_analysis:r11.1:::::::*

Information

Published : 2009-01-08 11:30

Updated : 2018-10-11 13:59

NVD link : CVE-2009-0043

Mitre link : CVE-2009-0043

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

ca

service_level_management
service_metric_analysis

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/33161", "name": "33161", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/07.aspx", "name": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/07.aspx", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=196148", "name": "https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=196148", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://securityreason.com/securityalert/4887", "name": "4887", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2009/0053", "name": "ADV-2009-0053", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/499857/100/0/threaded", "name": "20090107 CA20090107-01: CA Service Metric Analysis and CA Service Level Management smmsnmpd Arbitrary Command Execution Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access, which allows remote attackers to execute arbitrary commands via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-0043", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": true, "impactScore": 10.0, "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-01-08T19:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ca:service_level_management:3.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ca:service_metric_analysis:r11.1:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ca:service_metric_analysis:r11.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ca:service_metric_analysis:r11.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-11T20:59Z"}