CVE-2007-2343
Stack-based buffer overflow in the TFTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via crafted request packets that contain long file names.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.99%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Stack-based buffer overflow in the TFTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via crafted request packets that contain long file names.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 3.99% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- enterasys/netsight console · enterasys/netsight inventory manager
- Source
- cve@mitre.org
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506Vendor Advisory
- http://osvdb.org/34627
- http://secunia.com/advisories/24764Exploit, Vendor Advisory
- http://www.enterasys.com/pub/NetSight/Patches/SP1/NetSight_SP1.pdfPatch
- http://www.securitytracker.com/id?1017876
- http://www.vupen.com/english/advisories/2007/1271
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=506Vendor Advisory
- http://osvdb.org/34627
- http://secunia.com/advisories/24764Exploit, Vendor Advisory
- http://www.enterasys.com/pub/NetSight/Patches/SP1/NetSight_SP1.pdfPatch
- http://www.securitytracker.com/id?1017876
- http://www.vupen.com/english/advisories/2007/1271
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.