jvndb - jvndb-2011-000102

jvndb-2011-000102

Vulnerability from jvndb

Published

2011-12-15 16:26

Modified

2011-12-20 18:14

Severity ?

() - -

Summary

Multiple vulnerabilities in products that use the Preboot Execution Environment (PXE) SDK

Details

Products that use the Preboot Execution Environment (PXE) SDK sample code provided by Intel contain multiple vulnerabilities. Products that use the PXE SDK sample code provided by Intel contain directory traversal and buffer overflow vulnerabilities. Nobuyuki Kanaya of Fujitsu Laboratories Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN05255562/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0270
	NVD	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0270
	Buffer Errors(CWE-119)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	FUJITSU	SystemcastWizard Lite
	Hitachi, Ltd	JP1/ServerConductor/Deployment Manager
	Hitachi, Ltd	ServerConductor/Deployment Manager
	NEC Corporation	WebSAM DeploymentManager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000102.html",
  "dc:date": "2011-12-20T18:14+09:00",
  "dcterms:issued": "2011-12-15T16:26+09:00",
  "dcterms:modified": "2011-12-20T18:14+09:00",
  "description": "Products that use the Preboot Execution Environment (PXE) SDK sample code provided by Intel contain multiple vulnerabilities.\r\n\r\nProducts that use the PXE SDK sample code provided by Intel contain directory traversal and buffer overflow vulnerabilities.\r\n\r\nNobuyuki Kanaya of Fujitsu Laboratories Ltd. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000102.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:fujitsu:systemcastwizard_lite",
      "@product": "SystemcastWizard Lite",
      "@vendor": "FUJITSU",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:jp1_serverconductor_deployment_manager",
      "@product": "JP1/ServerConductor/Deployment Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:hitachi:serverconductor_deployment_manager",
      "@product": "ServerConductor/Deployment Manager",
      "@vendor": "Hitachi, Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:nec:websam_deploymentmanager",
      "@product": "WebSAM DeploymentManager",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.3",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2011-000102",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN05255562/index.html",
      "@id": "JVN#05255562",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0270",
      "@id": "CVE-2009-0270",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0270",
      "@id": "CVE-2009-0270",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "Multiple vulnerabilities in products that use the Preboot Execution Environment (PXE) SDK"
}

cve-2009-0270

Vulnerability from cvelistv5

Published

2009-01-26 19:00

Modified

2024-08-07 04:24

Severity ?

Summary

Stack-based buffer overflow in PXEService.exe in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to execute arbitrary code via a large PXE protocol request in a UDP packet.

References

▼	URL	Tags
	http://osvdb.org/51486	vdb-entry, x_refsource_OSVDB
	http://www.securityfocus.com/archive/1/500172/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.vupen.com/english/advisories/2009/0176	vdb-entry, x_refsource_VUPEN
	http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html	x_refsource_CONFIRM
	http://www.wintercore.com/advisories/advisory_W010109.html	x_refsource_MISC
	http://www.securityfocus.com/bid/33342	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/33594	third-party-advisory, x_refsource_SECUNIA

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:24:18.434Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "51486",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/51486"
          },
          {
            "name": "20090119 [Wintercore Research ] Fujitsu SystemcastWizard Lite PXEService Remote Buffer Overflow.",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500172/100/0/threaded"
          },
          {
            "name": "ADV-2009-0176",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0176"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.wintercore.com/advisories/advisory_W010109.html"
          },
          {
            "name": "33342",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33342"
          },
          {
            "name": "33594",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33594"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-01-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow in PXEService.exe in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to execute arbitrary code via a large PXE protocol request in a UDP packet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "51486",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/51486"
        },
        {
          "name": "20090119 [Wintercore Research ] Fujitsu SystemcastWizard Lite PXEService Remote Buffer Overflow.",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500172/100/0/threaded"
        },
        {
          "name": "ADV-2009-0176",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0176"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.wintercore.com/advisories/advisory_W010109.html"
        },
        {
          "name": "33342",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33342"
        },
        {
          "name": "33594",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33594"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0270",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack-based buffer overflow in PXEService.exe in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to execute arbitrary code via a large PXE protocol request in a UDP packet."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "51486",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/51486"
            },
            {
              "name": "20090119 [Wintercore Research ] Fujitsu SystemcastWizard Lite PXEService Remote Buffer Overflow.",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500172/100/0/threaded"
            },
            {
              "name": "ADV-2009-0176",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0176"
            },
            {
              "name": "http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html",
              "refsource": "CONFIRM",
              "url": "http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html"
            },
            {
              "name": "http://www.wintercore.com/advisories/advisory_W010109.html",
              "refsource": "MISC",
              "url": "http://www.wintercore.com/advisories/advisory_W010109.html"
            },
            {
              "name": "33342",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33342"
            },
            {
              "name": "33594",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33594"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0270",
    "datePublished": "2009-01-26T19:00:00",
    "dateReserved": "2009-01-26T00:00:00",
    "dateUpdated": "2024-08-07T04:24:18.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted