cnvd - cnvd-2017-01363

CNVD-2017-01363

Vulnerability from cnvd - Published: 2017-02-15

Title

多款Unisys产品拒绝服务漏洞

Description

UnisysLibra43xx等都是美国Unisys公司开发的基于MCP的应用程序系统架构。 UnisysLibra43xx、63xx、83xx和FS600class系统中的MCP-FIRMWARE40.0IC4Build270之前的40.0版本存在安全漏洞。远程攻击者可利用该漏洞造成拒绝服务（数据破坏和系统崩溃）。

Severity

中

Patch Name

多款Unisys产品拒绝服务漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40

Reference

http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40

Impacted products

Name
Unisys MCP-FIRMWARE 40.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-4049"
    }
  },
  "description": "UnisysLibra43xx\u7b49\u90fd\u662f\u7f8e\u56fdUnisys\u516c\u53f8\u5f00\u53d1\u7684\u57fa\u4e8eMCP\u7684\u5e94\u7528\u7a0b\u5e8f\u7cfb\u7edf\u67b6\u6784\u3002\r\n\r\nUnisysLibra43xx\u300163xx\u300183xx\u548cFS600class\u7cfb\u7edf\u4e2d\u7684MCP-FIRMWARE40.0IC4Build270\u4e4b\u524d\u768440.0\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u6570\u636e\u7834\u574f\u548c\u7cfb\u7edf\u5d29\u6e83\uff09\u3002",
  "discovererName": "Unisys",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-01363",
  "openTime": "2017-02-15",
  "patchDescription": "UnisysLibra43xx\u7b49\u90fd\u662f\u7f8e\u56fdUnisys\u516c\u53f8\u5f00\u53d1\u7684\u57fa\u4e8eMCP\u7684\u5e94\u7528\u7a0b\u5e8f\u7cfb\u7edf\u67b6\u6784\u3002\r\n\r\nUnisysLibra43xx\u300163xx\u300183xx\u548cFS600class\u7cfb\u7edf\u4e2d\u7684MCP-FIRMWARE40.0IC4Build270\u4e4b\u524d\u768440.0\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u6570\u636e\u7834\u574f\u548c\u7cfb\u7edf\u5d29\u6e83\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eUnisys\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Unisys MCP-FIRMWARE 40.0"
  },
  "referenceLink": "http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40",
  "serverity": "\u4e2d",
  "submitTime": "2017-02-09",
  "title": "\u591a\u6b3eUnisys\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2015-4049 (GCVE-0-2015-4049)

Vulnerability from cvelistv5 – Published: 2017-02-03 19:00 – Updated: 2024-08-06 06:04

Summary

Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data corruption or system crash) via vectors related to using program operators during EPSILON (level 5) based codefiles at peak memory usage, which triggers CPM stack corruption.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

http://public.support.unisys.com/common/public/vu…

x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T06:04:02.725Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-02-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data corruption or system crash) via vectors related to using program operators during EPSILON (level 5) based codefiles at peak memory usage, which triggers CPM stack corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-03T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-4049",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data corruption or system crash) via vectors related to using program operators during EPSILON (level 5) based codefiles at peak memory usage, which triggers CPM stack corruption."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40",
              "refsource": "CONFIRM",
              "url": "http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=40"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-4049",
    "datePublished": "2017-02-03T19:00:00",
    "dateReserved": "2015-05-20T00:00:00",
    "dateUpdated": "2024-08-06T06:04:02.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-01363

CVE-2015-4049 (GCVE-0-2015-4049)

Tags

Sightings

Nomenclature