F-Secure Multiple Products Web Console Pre-authentication Overflow RCE

high Nessus Plugin ID 21644

Synopsis

An antivirus application installed on the remote host is affected by a remote code execution vulnerability.

Description

The version of F-Secure Internet Gatekeeper and/or F-Secure Anti-Virus for Microsoft Exchange installed on the remote host is affected by a buffer overflow condition in its web console. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

Note that the web console by default accepts connections only from the local host; therefore, this issue can be exploited remotely only if the web console has been specifically configured to accept connections remotely.

Solution

Apply the appropriate hotfix as described in the vendor advisory.

Plugin Details

Severity: High

ID: 21644

File Name: fsecure_web_console_overflow.nasl

Version: 1.17

Type: local

Agent: windows

Family: Windows

Published: 6/6/2006

Updated: 7/11/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f-secure:f-secure_anti-virus, cpe:/a:f-secure:internet_gatekeeper

Required KB Items: SMB/name, SMB/login, SMB/password, SMB/registry_full_access, SMB/transport

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/1/2006

Reference Information

CVE: CVE-2006-2838

BID: 18201

Detections

Analytics