CVE-2012-0409
EMC AutoStart ftAgent Opcode 0x2d Subcode 0x1194 Parsing Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.3 allow remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via crafted packets.
Múltiples desbordamientos de búfer en EMC AutoStart v5.3.x y v5.4.x antes de v5.4.3, permite a atacantes remotos causar una denegación de servicio (caída del agente) o posiblemente ejecutar código arbitrario a través de paquetes manipulados.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the EMC Autostart ftAgent, which is deployed on machines managed by EMC Autostart by default. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing routines for op-codes used by EMC Autostart ftAgent's proprietary network protocol. This ftAgent.exe service listens on TCP port 8045, and performs arithmetic for memory size calculation using values read from the network without validation. This arithmetic is susceptible to integer overflow, causing the memory allocation to be undersized, ultimately allowing for heap-based memory corruption. An attacker can exploit this condition to gain remote code execution as user SYSTEM.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-01-09 CVE Reserved
- 2012-05-24 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/522835 | Mailing List | |
| http://www.securityfocus.com/bid/53682 | Vdb Entry | |
| http://www.securitytracker.com/id?1027100 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Emc Search vendor "Emc" | Autostart Search vendor "Emc" for product "Autostart" | 5.3 Search vendor "Emc" for product "Autostart" and version "5.3" | - |
Affected
| ||||||
| Emc Search vendor "Emc" | Autostart Search vendor "Emc" for product "Autostart" | 5.3 Search vendor "Emc" for product "Autostart" and version "5.3" | sp1 |
Affected
| ||||||
| Emc Search vendor "Emc" | Autostart Search vendor "Emc" for product "Autostart" | 5.3 Search vendor "Emc" for product "Autostart" and version "5.3" | sp2 |
Affected
| ||||||
| Emc Search vendor "Emc" | Autostart Search vendor "Emc" for product "Autostart" | 5.3 Search vendor "Emc" for product "Autostart" and version "5.3" | sp3 |
Affected
| ||||||
| Emc Search vendor "Emc" | Autostart Search vendor "Emc" for product "Autostart" | 5.4 Search vendor "Emc" for product "Autostart" and version "5.4" | - |
Affected
| ||||||
| Emc Search vendor "Emc" | Autostart Search vendor "Emc" for product "Autostart" | 5.4.1 Search vendor "Emc" for product "Autostart" and version "5.4.1" | - |
Affected
| ||||||
| Emc Search vendor "Emc" | Autostart Search vendor "Emc" for product "Autostart" | 5.4.2 Search vendor "Emc" for product "Autostart" and version "5.4.2" | - |
Affected
| ||||||