WEKA INTEREST Security Scanner 1.8 HTTP отказ в обслуживании

В проблемные обнаружена уязвимость, классифицированная как WEKA INTEREST Security Scanner 1.8. Затронута неизвестная функция компонента HTTP Handler. Определение CWE для уязвимости следующее CWE-404. Вопрос введен в 01.10.2005. Ошибка была обнаружена 30.07.2007. Консультация представлена на сайте vuldb.com. Продавец не участвовал в публичном выпуске. Выявление этой уязвимости является CVE-2017-20011. Для проведения этой атаки необходим локальный доступ. Технические подробности отсутствуют. Более того, существует эксплойт. Эксплойт был раскрыт общественности и может быть использован. Текущая цена за эксплойт может составлять около USD $0-$5k в настоящее время. Объявляется proof-of-concept. Эксплойт доступен по адресу vuldb.com. Уязвимость обрабатывалась как непубличный эксплойт нулевого дня в течение как минимум 4265 дней. Мы ожидаем, что 0-день стоил приблизительно $0-$5k. Возможной альтернативой является ATK - Attack Tool Kit. Рекомендуется заменить пораженный компонент на альтернативный.

Поле28.01.2022 12:0807.12.2022 17:2107.12.2022 17:29
publicity111
urlhttps://vuldb.com/?id.101969https://vuldb.com/?id.101969https://vuldb.com/?id.101969
developer_nameMarc RuefMarc RuefMarc Ruef
developer_websitehttps://www.computec.ch/mruef/https://www.computec.ch/mruef/https://www.computec.ch/mruef/
price_0day$0-$5k$0-$5k$0-$5k
nameАльтернативаАльтернативаАльтернатива
alternative_nameATK - Attack Tool KitATK - Attack Tool KitATK - Attack Tool Kit
heise136437136437136437
mischttp://www.computec.ch/news.php?item.117http://www.computec.ch/news.php?item.117http://www.computec.ch/news.php?item.117
seealso101970 101971 101972 101973 101974101970 101971 101972 101973 101974101970 101971 101972 101973 101974
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rlUUU
cvss2_vuldb_rcCCC
cvss3_vuldb_ePPP
cvss3_vuldb_rlUUU
cvss3_vuldb_rcCCC
0day_days426542654265
developer_mailmarc.ruef@********.**marc.ruef@********.**marc.ruef@********.**
vendorWEKAWEKAWEKA
nameINTEREST Security ScannerINTEREST Security ScannerINTEREST Security Scanner
version1.81.81.8
componentHTTP HandlerHTTP HandlerHTTP Handler
introductiondate112812480011281248001128124800
discoverydate118575360011857536001185753600
risk111
historic000
cvss2_vuldb_basescore1.71.71.7
cvss2_vuldb_tempscore1.51.51.5
cvss2_vuldb_avLLL
cvss2_vuldb_acLLL
cvss2_vuldb_auSSS
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss3_meta_basescore2.82.83.7
cvss3_meta_tempscore2.72.73.7
cvss3_vuldb_basescore2.82.82.8
cvss3_vuldb_tempscore2.72.72.7
cvss3_vuldb_avLLL
cvss3_vuldb_acLLL
cvss3_vuldb_prLLL
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
advisoryquoteThis version does not send a newline twice within HTTP plugins which leads to corrupt HTTP requests. These are not able to determine any issues.This version does not send a newline twice within HTTP plugins which leads to corrupt HTTP requests. These are not able to determine any issues.This version does not send a newline twice within HTTP plugins which leads to corrupt HTTP requests. These are not able to determine any issues.
date1496620800 (05.06.2017)1496620800 (05.06.2017)1496620800 (05.06.2017)
locationVulDBVulDBVulDB
typeEntryEntryEntry
urlhttps://vuldb.com/?id.101969https://vuldb.com/?id.101969https://vuldb.com/?id.101969
identifierID 101969ID 101969ID 101969
coordination000
person_nameMarc RuefMarc RuefMarc Ruef
person_mailmaru@****.**maru@****.**maru@****.**
person_websitehttps://www.computec.ch/mruef/https://www.computec.ch/mruef/https://www.computec.ch/mruef/
company_namescip AGscip AGscip AG
advisoryquoteThe Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.The Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.The Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.
availability111
date1496620800 (05.06.2017)1496620800 (05.06.2017)1496620800 (05.06.2017)
cwe404 (отказ в обслуживании)404 (отказ в обслуживании)404 (отказ в обслуживании)
typeSecurity Testing SoftwareSecurity Testing SoftwareSecurity Testing Software
cveCVE-2017-20011CVE-2017-20011CVE-2017-20011
cve_cnaVulDBVulDBVulDB
responsibleVulDBVulDBVulDB
eol111
cve_assigned1643324400 (28.01.2022)1643324400 (28.01.2022)
cve_nvd_summary** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WEKA INTEREST Security Scanner 1.8. It has been rated as problematic. This issue affects some unknown processing of the component HTTP Handler. The manipulation with an unknown input leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WEKA INTEREST Security Scanner 1.8. It has been rated as problematic. This issue affects some unknown processing of the component HTTP Handler. The manipulation with an unknown input leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
cvss3_nvd_avL
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iN
cvss3_nvd_aH
cvss2_nvd_avL
cvss2_nvd_acL
cvss2_nvd_auN
cvss2_nvd_ciN
cvss2_nvd_iiN
cvss2_nvd_aiP
cvss3_cna_avL
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iN
cvss3_cna_aL
cvss2_nvd_basescore2.1
cvss3_nvd_basescore5.5
cvss3_cna_basescore2.8

◂ ПредыдущийОбзорДалее ▸

Interested in the pricing of exploits?

See the underground prices here!