Cve-2017-12754.You are viewing this page in an unauthorized frame window.
CertMain Menu.CVE – Alert Detail – Security Database
Aug 31, · Nasty httpd exploit – CVE Thread starter bsdsource; Start date Aug 29, ; ATTENTION! As of November 1, , you are not able to reply to threads 6 months after the thread is opened if there are more than posts in the thread. Threads will not be locked, so posts may still be edited by their authors. CVE® is a list of records — each containing an identification number, a description, and at least one public reference — for publicly known cybersecurity vulnerabilities. The mission of the CVE Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. CVE Adobe Acrobat and Reader and earlier, and earlier, and and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Cve-2017-12754.CVE – CVSS Calculator – Security Database
Aug 09, · CVE Stack buffer overflow in httpd in Asuswrt-Merlin firmware _0RT-AC and earlier for ASUS devices and ASUS firmware for ASUS RT-AC, RT_ACP, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U, RT-AC56U, RT-AC55U, RT-AC52U, RT-AC51U, RT-N18U, RT-N66U, RT-N56U, RT-AC, RT-AC, RT_ACGU, / CVE Exec Code Overflow None: Remote: Low: Single system: Partial: Partial: Partial: Stack buffer overflow in httpd in Asuswrt-Merlin firmware _0RT-AC and earlier for ASUS devices and ASUS firmware for ASUS RT-AC, RT_ACP, RT-AC68U, RT-AC68P, RT-AC88U, RT-AC66U, RT-AC66U_B1, RT-AC58U. Informations; Name: CVE First vendor Publication: Vendor: Cve: Last vendor Modification:
Asuswrt : Security vulnerabilities
Vulnerability Summary for the Week of August 7, 2017
Vulnerability Summary for the Week of August 7, | CISA
Security-Database help your corporation foresee and avoid any security risks that may impact your IT infrastructure and business applications. Copyright Security-Database – Powered by themself ; in 0.
Facebook rss twitter linkedin mail. Login Search. For more informations, check here. Local: A vulnerability exploitable with only local access requires the attacker to have either physical access to the vulnerable system or a local shell account. Adjacent network: A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software. Network: A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access.
Such a vulnerability is often termed “remotely exploitable”. An example of a network attack is an RPC buffer overflow. High; Specialized access conditions exist.
For example: In most configurations, the attacking party must already have elevated privileges or spoof additional systems in addition to the attacking system e.
The attack depends on social engineering methods that would be easily detected by knowledgeable people. For example, the victim must perform several suspicious or atypical actions. The vulnerable configuration is seen very rarely in practice. If a race condition exists, the window is very narrow. Medium: The access conditions are somewhat specialized; the following are examples: The attacking party is limited to a group of systems or users at some level of authorization, possibly untrusted.
Some information must be gathered before a successful attack can be launched. The affected configuration is non-default, and is not commonly configured e. The attack requires a small amount of social engineering that might occasionally fool cautious users e.
Low: Specialized access conditions or extenuating circumstances do not exist. The following are examples: The affected product typically requires access to a wide range of systems and users, possibly anonymous and untrusted e. The affected configuration is default or ubiquitous. The attack can be performed manually and requires little skill or additional information gathering.
The “race condition” is a lazy one i. Requires multiple instances: Exploiting the vulnerability requires that the attacker authenticate two or more times, even if the same credentials are used each time. An example is an attacker authenticating to an operating system in addition to providing credentials to access an application hosted on that system.
Requires single instance: The vulnerability requires an attacker to be logged into the system such as at a command line or via a desktop session or web interface. None: There is no impact to the confidentiality of the system. Partial: There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained.
An example is a vulnerability that divulges only certain tables in a database. Complete: There is total information disclosure, resulting in all system files being revealed.
The attacker is able to read all of the system’s data memory, files, etc. None: There is no impact to the integrity of the system. Partial: Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.
For example, system or application files may be overwritten or modified, but either the attacker has no control over which files are affected or the attacker can modify files within only a limited context or scope. Complete: There is a total compromise of system integrity.
There is a complete loss of system protection, resulting in the entire system being compromised. The attacker is able to modify any files on the target system. None: There is no impact to the availability of the system.
Partial: There is reduced performance or interruptions in resource availability. An example is a network-based flood attack that permits a limited number of successful connections to an Internet service. Complete: There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.
Low: Loss of [confidentiality integrity availability] is likely to have only a limited adverse effect on the organization or individuals associated with the organization e. Medium: Loss of [confidentiality integrity availability] is likely to have a serious adverse effect on the organization or individuals associated with the organization e.
High: Loss of [confidentiality integrity availability] is likely to have a catastrophic adverse effect on the organization or individuals associated with the organization e. Not Defined: Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. None: There is no potential for loss of life, physical assets, productivity or revenue. Low: A successful exploit of this vulnerability may result in slight physical or property damage.
Or, there may be a slight loss of revenue or productivity to the organization. Low-Medium: A successful exploit of this vulnerability may result in moderate physical or property damage. Or, there may be a moderate loss of revenue or productivity to the organization.
Medium-High: A successful exploit of this vulnerability may result in significant physical or property damage or loss.
Or, there may be a significant loss of revenue or productivity. High: A successful exploit of this vulnerability may result in catastrophic physical or property damage and loss. Or, there may be a catastrophic loss of revenue or productivity. Unproven: No exploit code is available, or an exploit is entirely theoretical.
Proof-of-concept: Proof-of-concept exploit code or an attack demonstration that is not practical for most systems is available. The code or technique is not functional in all situations and may require substantial modification by a skilled attacker. Functional: Functional exploit code is available. The code works in most situations where the vulnerability exists.
High: Either the vulnerability is exploitable by functional mobile autonomous code, or no exploit is required manual trigger and details are widely available. The code works in every situation, or is actively being delivered via a mobile autonomous agent such as a worm or virus. Official-fix: A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
Temporary-fix: There is an official but temporary fix available. This includes instances where the vendor issues a temporary hotfix, tool, or workaround. Workaround: There is an unofficial, non-vendor solution available. In some cases, users of the affected technology will create a patch of their own or provide steps to work around or otherwise mitigate the vulnerability.
Unavailable: There is either no solution available or it is impossible to apply. Unconfirmed: There is a single unconfirmed source or possibly multiple conflicting reports. There is little confidence in the validity of the reports. An example is a rumor that surfaces from the hacker underground. Uncorroborated: There are multiple non-official sources, possibly including independent security companies or research organizations.
At this point there may be conflicting technical details or some other lingering ambiguity. Confirmed: The vulnerability has been acknowledged by the vendor or author of the affected technology. The vulnerability may also be “confirmed” when its existence is confirmed from an external event such as publication of functional or proof-of-concept exploit code or widespread exploitation.
CPE Deprecated Dictionary integration.