Detections
Analytics

Rocket Software UniData < 7.3 unidata72 Remote Command Execution (credentialed check)

critical Nessus Plugin ID 59607

Language:

Synopsis

An RPC service on the remote Windows host allows commands to be run without authentication.

Description

The version of UniData installed on the remote Windows host is potentially affected by a code execution vulnerability. The UniData RPC service fails to enforce authentication on the unidata72 interface.

An unauthenticated, remote attacker can exploit this vulnerability to execute arbitrary code on the remote host with SYSTEM level privileges.

Solution

Upgrade to UniData 7.3 or later.

See Also

https://www.tenable.com/security/research/tra-2012-05

https://www.usploit.com/index.php?advisories/view/UPS-2012-0012

Plugin Details

Severity: Critical

ID: 59607

File Name: rocketsoftware_unidata_73_cmd_exec.nasl

Version: 1.7

Type: local

Agent: windows

Family: Windows

Published: 6/20/2012

Updated: 8/8/2018

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

CPE: x-cpe:/a:rocketsoftware:unidata

Required KB Items: SMB/RocketSoftware/UniData/installed

Exploit Ease: No known exploits are available

Patch Publication Date: 6/9/2012

Vulnerability Publication Date: 6/9/2012

Reference Information

BID: 53974