Flexense Disk Pulse Enterprise 10.1.18 Control Protocol SERVER_GET_INFO Packet security check

Summaryinfo

A vulnerability categorized as problematic has been discovered in Flexense Disk Pulse Enterprise 10.1.18. The affected element is an unknown function of the component Control Protocol Handler. Executing a manipulation as part of SERVER_GET_INFO Packet can lead to security check. This vulnerability is registered as CVE-2017-15663. It is possible to launch the attack remotely. Furthermore, an exploit is available. The application of restrictive firewalling is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Flexense Disk Pulse Enterprise 10.1.18. This vulnerability affects an unknown functionality of the component Control Protocol Handler. The manipulation as part of a SERVER_GET_INFO Packet leads to a security check vulnerability. The CWE definition for the vulnerability is CWE-358. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique. As an impact it is known to affect availability. CVE summarizes:

In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.

The bug was discovered 01/08/2018. The weakness was published 01/10/2018 as EDB-ID 43452 as not defined exploit (Exploit-DB). The advisory is shared for download at exploit-db.com. This vulnerability was named CVE-2017-15663 since 10/19/2017. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1211.

After immediately, there has been an exploit disclosed. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

Proper firewalling of 9120 is able to address this issue.

The vulnerability is also documented in the vulnerability database at Exploit-DB (43452). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Flexense

Name

• Disk Pulse Enterprise

Version

• 10.1.18

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion