WEKA INTEREST Security Scanner до 1.8 Stresstest Scheme отказ в обслуживании

Уязвимость, классифицированная как проблемные, была найдена в WEKA INTEREST Security Scanner до 1.8. Затронута неизвестная функция компонента Stresstest Scheme Handler. Использование CWE для объявления проблемы приводит к тому, что CWE-404. Ошибка была обнаружена 30.07.2007. Консультация доступна по адресу vuldb.com. Публичный релиз произошел без согласования с поставщиком. Эта уязвимость продается как CVE-2017-20012. Атаковать локально - это обязательное условие. Технические подробности отсутствуют. Более того, существует эксплойт. Эксплойт был раскрыт общественности и может быть использован. Текущая цена за эксплойт может составлять около USD $0-$5k в настоящее время. Объявляется proof-of-concept. Эксплойт доступен для загрузки на сайте vuldb.com. Уязвимость обрабатывалась как непубличный эксплойт нулевого дня в течение как минимум 3598 дней. В 0-дневный период предполагаемая подземная цена составляла около $0-$5k. Возможной альтернативой является ATK - Attack Tool Kit. Рекомендуется заменить пораженный компонент на альтернативный.

Поле02.03.2022 08:4407.12.2022 17:3607.12.2022 17:43
vendorWEKAWEKAWEKA
nameINTEREST Security ScannerINTEREST Security ScannerINTEREST Security Scanner
version<=1.8<=1.8<=1.8
componentStresstest Scheme HandlerStresstest Scheme HandlerStresstest Scheme Handler
discoverydate118575360011857536001185753600
risk111
historic000
cvss2_vuldb_basescore1.71.71.7
cvss2_vuldb_tempscore1.51.51.5
cvss2_vuldb_avLLL
cvss2_vuldb_acLLL
cvss2_vuldb_auSSS
cvss2_vuldb_ciNNN
cvss2_vuldb_iiNNN
cvss2_vuldb_aiPPP
cvss3_meta_basescore2.82.83.7
cvss3_meta_tempscore2.72.73.7
cvss3_vuldb_basescore2.82.82.8
cvss3_vuldb_tempscore2.72.72.7
cvss3_vuldb_avLLL
cvss3_vuldb_acLLL
cvss3_vuldb_prLLL
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iNNN
cvss3_vuldb_aLLL
advisoryquoteThe stresstest module requires the url to begin with an http scheme. Without that no requests are sent over the network.The stresstest module requires the url to begin with an http scheme. Without that no requests are sent over the network.The stresstest module requires the url to begin with an http scheme. Without that no requests are sent over the network.
date1496620800 (05.06.2017)1496620800 (05.06.2017)1496620800 (05.06.2017)
locationVulDBVulDBVulDB
typeEntryEntryEntry
urlhttps://vuldb.com/?id.101969https://vuldb.com/?id.101969https://vuldb.com/?id.101969
identifierVDB-101969VDB-101969VDB-101969
developer_mailmarc.ruef@********.**marc.ruef@********.**marc.ruef@********.**
coordination000
person_nameMarc RuefMarc RuefMarc Ruef
person_mailmaru@****.**maru@****.**maru@****.**
person_websitehttp://www.computec.ch/mruef/http://www.computec.ch/mruef/http://www.computec.ch/mruef/
company_namescip AGscip AGscip AG
advisoryquoteThe Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.The Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.The Attack Tool Kit (ATK) is an exploiting framwork published under GPL3. Back in 2006 there was a legal dispute between the developer Marc Ruef and the German company WEKA. Ruef claimed that WEKA violated the open-source license while they were using parts of the project within their commercial vulnerability scanner. During the technical analysis of INTEREST SEcurity Scanner several security issues, which affect the handling of the vulnerability scanner, got determined.
availability111
date1496620800 (05.06.2017)1496620800 (05.06.2017)1496620800 (05.06.2017)
publicity111
urlhttps://vuldb.com/?id.101969https://vuldb.com/?id.101969https://vuldb.com/?id.101969
developer_nameMarc RuefMarc RuefMarc Ruef
developer_websitehttps://www.computec.ch/mruef/https://www.computec.ch/mruef/https://www.computec.ch/mruef/
price_0day$0-$5k$0-$5k$0-$5k
nameАльтернативаАльтернативаАльтернатива
alternative_nameATK - Attack Tool KitATK - Attack Tool KitATK - Attack Tool Kit
heise136437136437136437
mischttp://www.computec.ch/news.php?item.117http://www.computec.ch/news.php?item.117http://www.computec.ch/news.php?item.117
seealso101969 101971 101972 101973 101974101969 101971 101972 101973 101974101969 101971 101972 101973 101974
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rlUUU
cvss2_vuldb_rcCCC
cvss3_vuldb_ePPP
cvss3_vuldb_rlUUU
cvss3_vuldb_rcCCC
0day_days359835983598
typeSecurity Testing SoftwareSecurity Testing SoftwareSecurity Testing Software
cwe404 (отказ в обслуживании)404 (отказ в обслуживании)404 (отказ в обслуживании)
cveCVE-2017-20012CVE-2017-20012CVE-2017-20012
cve_cnaVulDBVulDBVulDB
responsibleVulDBVulDBVulDB
eol111
cve_assigned1643324400 (28.01.2022)1643324400 (28.01.2022)
cve_nvd_summary** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in WEKA INTEREST Security Scanner up to 1.8. Affected is Stresstest Scheme Handler which leads to a denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in WEKA INTEREST Security Scanner up to 1.8. Affected is Stresstest Scheme Handler which leads to a denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
cvss3_nvd_avL
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iN
cvss3_nvd_aH
cvss2_nvd_avL
cvss2_nvd_acL
cvss2_nvd_auN
cvss2_nvd_ciN
cvss2_nvd_iiN
cvss2_nvd_aiP
cvss3_cna_avL
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iN
cvss3_cna_aL
cvss2_nvd_basescore2.1
cvss3_nvd_basescore5.5
cvss3_cna_basescore2.8

◂ ПредыдущийОбзорДалее ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!