KLA10098 Vulnerability in CVSNT

2014-08-0800:00:00

Kaspersky Lab

threats.kaspersky.com

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.6 High

AI Score

Confidence

Low

0.063 Low

EPSS

Percentile

93.6%

JSON

An unspecified vulnerability was found in CVSNT. By exploiting this vulnerability malicious users can bypass permission checks, modify directories and execute arbitrary code. This vulnerability can be exploited remotely via specially designed branching.

Original advisories

March Hare bulletin

Related products

CVSNT

MarchHare-CVS-Suite

CVE list

CVE-2010-1326 critical

Solution

Update to latest version

Impacts

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

Affected Products

March Hare Software CVSNT versions from 2.0.58 to 2.5.03 build 3736March Hare Software CVSNT version 2.5.04 builds up to 2862March Hare Software CVS Suite version 2.5.03March Hare Software CVS Suite version 2008 builds up to 3736March Hare Software CVS Suite version 2009 builds up to 3729