A vulnerability classified as very critical has been found in Twd-industries Remote-Anything 5.60.15. This affects an unknown function. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafted flm file.

The weakness was published 07/25/2012 by Patrick (Website). The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2012-4057 since 07/25/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/19/2019).

A public exploit has been developed in Python. The exploit is shared for download at securityfocus.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (75237) and Exploit-DB (18799).

Productinfo

Vendor

• Twd-industries

Name

• Remote-Anything

Version

• 5.60.15

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion