7.2

CVE-2010-1906

Exploit
tgsrv.exe in the Repair Service in Consona Dynamic Agent, Repair Manager, Subscriber Activation, and Subscriber Agent relies on a predictable timestamp field to validate input to the \\.\pipe\__RepairService_pipe__company named pipe, which allows remote authenticated users to execute arbitrary code by obtaining the current time from (1) tcpip.sys or (2) an SMB2 service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Consona ≫ Consona Dynamic Agent Version- Update- Editionenterprise
Consona ≫ Consona Dynamic Agent Version- Update- Editionmarketing
Consona ≫ Consona Dynamic Agent Version- Update- Editionsupport
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.03% 0.893
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://wintercore.com/en/component/content/article/7-media/18-wintercore-releases-an-advisory-for-consona-products.html
http://www.consona.com/Content/CRM/Support/SecurityBulletin_April2010.pdf
Patch
Vendor Advisory
http://www.kb.cert.org/vuls/id/602801
Patch
US Government Resource
http://www.securityfocus.com/archive/1/511176/100/0/threaded
http://www.wintercore.com/downloads/rootedcon_0day.pdf
Exploit
http://secunia.com/advisories/39752
Vendor Advisory