Flexense VX Search Enterprise 10.1.12 Control Protocol SERVER_GET_INFO Packet security check

Summaryinfo

A vulnerability was found in Flexense VX Search Enterprise 10.1.12. It has been rated as problematic. Impacted is an unknown function of the component Control Protocol Handler. Performing a manipulation as part of SERVER_GET_INFO Packet results in security check. This vulnerability is cataloged as CVE-2017-15662. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability classified as problematic has been found in Flexense VX Search Enterprise 10.1.12. This affects an unknown function of the component Control Protocol Handler. The manipulation as part of a SERVER_GET_INFO Packet leads to a security check vulnerability. CWE is classifying the issue as CWE-358. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique. This is going to have an impact on availability. The summary by CVE is:

In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.

The bug was discovered 01/08/2018. The weakness was shared 01/10/2018 as EDB-ID 43451 as not defined exploit (Exploit-DB). It is possible to read the advisory at exploit-db.com. This vulnerability is uniquely identified as CVE-2017-15662 since 10/19/2017. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1211 according to MITRE ATT&CK.

After immediately, there has been an exploit disclosed. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

It is possible to mitigate the weakness by firewalling 9123.

The vulnerability is also documented in the vulnerability database at Exploit-DB (43451). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Flexense

Name

• VX Search Enterprise

Version

• 10.1.12

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion