WEKA INTEREST Security Scanner hasta 1.8 Portscan denegación de servicio

Una vulnerabilidad ha sido encontrada en WEKA INTEREST Security Scanner hasta 1.8 y clasificada como problemática. Una función desconocida del componente Portscan es afectada por esta vulnerabilidad. Mediante la manipulación de un input desconocido se causa una vulnerabilidad de clase denegación de servicio. El error fue descubierto el 2007-07-30. El advisory puede ser descargado de vuldb.com. La publicación se hizo sin la colaboración del fabricante. La vulnerabilidad es identificada como CVE-2017-20016. El ataque puede ser realizado a través de la red. Fue declarado como proof-of-concept. El exploit puede ser descargado de vuldb.com. Esta vulnerabilidad ha sido clasificada como un exploit día cero por lo menos por 3598 días. El problema puede ser mitigado reemplazando el componente con ATK - Attack Tool Kit como alternativa. El mejor modo sugerido para mitigar el problema es utilizar un producto alternativo. Una solución posible ha sido publicada incluso antes y no después de la publicación de la vulnerabilidad.

Campo2022-01-28 12:282022-12-07 18:352022-12-07 18:42
vendorWEKAWEKAWEKA
nameINTEREST Security ScannerINTEREST Security ScannerINTEREST Security Scanner
version<=1.8<=1.8<=1.8
componentPortscanPortscanPortscan
discoverydate118575360011857536001185753600
risk111
historic000
cvss2_vuldb_basescore4.34.34.3
cvss2_vuldb_tempscore3.93.93.9
cvss2_vuldb_avNNN
cvss2_vuldb_acMMM
cvss2_vuldb_auNNN
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss3_meta_basescore4.34.35.4
cvss3_meta_tempscore4.14.15.3
cvss3_vuldb_basescore4.34.34.3
cvss3_vuldb_tempscore4.14.14.1
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
advisoryquoteAfter a portscan the software connects to chargen services which will cause a memory exhaustion.After a portscan the software connects to chargen services which will cause a memory exhaustion.After a portscan the software connects to chargen services which will cause a memory exhaustion.
date1496620800 (2017-06-05)1496620800 (2017-06-05)1496620800 (2017-06-05)
locationVulDBVulDBVulDB
typeEntryEntryEntry
urlhttps://vuldb.com/?id.101969https://vuldb.com/?id.101969https://vuldb.com/?id.101969
identifierID 101969ID 101969ID 101969
coordination000
person_nameMarc RuefMarc RuefMarc Ruef
person_mailmaru@****.**maru@****.**maru@****.**
person_websitehttp://www.computec.ch/mruef/http://www.computec.ch/mruef/http://www.computec.ch/mruef/
company_namescip AGscip AGscip AG
advisoryquoteThe Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.The Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.The Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.
availability111
date1496620800 (2017-06-05)1496620800 (2017-06-05)1496620800 (2017-06-05)
publicity111
urlhttps://vuldb.com/?id.101974https://vuldb.com/?id.101974https://vuldb.com/?id.101974
developer_nameMarc RuefMarc RuefMarc Ruef
developer_websitehttps://www.computec.ch/mruef/https://www.computec.ch/mruef/https://www.computec.ch/mruef/
price_0day$0-$5k$0-$5k$0-$5k
nameAlternativeAlternativeAlternative
alternative_nameATK - Attack Tool KitATK - Attack Tool KitATK - Attack Tool Kit
advisoryquoteA restart of the software is not enough to eliminate this issue. De-installing and re-installing the whole software is required.A restart of the software is not enough to eliminate this issue. De-installing and re-installing the whole software is required.A restart of the software is not enough to eliminate this issue. De-installing and re-installing the whole software is required.
heise136437136437136437
mischttp://www.computec.ch/news.php?item.117http://www.computec.ch/news.php?item.117http://www.computec.ch/news.php?item.117
seealso101969 101970 101971 101972 101973101969 101970 101971 101972 101973101969 101970 101971 101972 101973
developer_mailmarc.ruef@********.**marc.ruef@********.**marc.ruef@********.**
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rlUUU
cvss2_vuldb_rcCCC
cvss3_vuldb_ePPP
cvss3_vuldb_rlUUU
cvss3_vuldb_rcCCC
0day_days359835983598
typeSecurity Testing SoftwareSecurity Testing SoftwareSecurity Testing Software
cwe789 (denegación de servicio)789 (denegación de servicio)789 (denegación de servicio)
cveCVE-2017-20016CVE-2017-20016CVE-2017-20016
cve_cnaVulDBVulDBVulDB
responsibleVulDBVulDBVulDB
eol111
cve_assigned1643324400 (2022-01-28)1643324400 (2022-01-28)
cve_nvd_summary** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iN
cvss3_nvd_aH
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auN
cvss2_nvd_ciN
cvss2_nvd_iiN
cvss2_nvd_aiP
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prN
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iN
cvss3_cna_aL
cvss2_nvd_basescore5.0
cvss3_nvd_basescore7.5
cvss3_cna_basescore4.3

Want to stay up to date on a daily basis?

Enable the mail alert feature now!