CVE-2011-1852
HP 3COM/H3C Intelligent Management Center tftpserver DATA/ERROR Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple stack-based buffer overflows in tftpserver.exe in HP Intelligent Management Center (IMC) 5.0 before E0101L02 allow remote attackers to execute arbitrary code via crafted packet content accompanying a (1) DATA or (2) ERROR opcode.
Múltiples desbordamientos de búfer basado en pila en tftpserver.exe en HP Intelligent Management Center (IMC) v5.0 antes de E0101L02 permite a atacantes remotos ejecutar código de su elección a través de un paquete de contenido manipulado acompañando un opcode (1) DATA o (2) ERROR.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP 3COM/H3C Intelligent Management Center. Authentication is not required to exploit this vulnerability.
The flaw exists within the tftpserver.exe component which listens by default on UDP port 69. When handling a TFTP packet type 0x03 or 0x05 (DATA or ERROR) the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-05-03 CVE Reserved
- 2011-05-10 CVE Published
- 2024-09-17 CVE Updated
- 2024-10-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://securitytracker.com/id?1025519 | Vdb Entry | |
| http://www.securityfocus.com/bid/47789 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-11-164 | X_refsource_misc |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02822750 | 2013-07-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hp Search vendor "Hp" | Intelligent Management Center Search vendor "Hp" for product "Intelligent Management Center" | 5.0 Search vendor "Hp" for product "Intelligent Management Center" and version "5.0" | - |
Affected
| ||||||
| Hp Search vendor "Hp" | Intelligent Management Center Search vendor "Hp" for product "Intelligent Management Center" | 5.0 Search vendor "Hp" for product "Intelligent Management Center" and version "5.0" | e0101 |
Affected
| ||||||
| Hp Search vendor "Hp" | Intelligent Management Center Search vendor "Hp" for product "Intelligent Management Center" | 5.0 Search vendor "Hp" for product "Intelligent Management Center" and version "5.0" | e0101l01 |
Affected
| ||||||