CVE-2018-8065

An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory region that can be triggered by rapidly sending a variety of HTTP requests with long HTTP header values or long URIs.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/172676/Flexense-HTTP-Server-10.6.24-Buffer-Overflow-Denial-Of-Service.html
https://github.com/EgeBalci/Sync_Breeze_Enterprise_10_6_24_-DOS	Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/9701	Issue Tracking Third Party Advisory
http://packetstormsecurity.com/files/172676/Flexense-HTTP-Server-10.6.24-Buffer-Overflow-Denial-Of-Service.html
https://github.com/EgeBalci/Sync_Breeze_Enterprise_10_6_24_-DOS	Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/9701	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flexense:syncbreeze:10.6.24:*:*:*:enterprise:*:*:*

History

No history.

Information

Published : 2018-03-12 04:29

Updated : 2024-11-21 04:13

NVD link : CVE-2018-8065

Mitre link : CVE-2018-8065

CVE.ORG link : CVE-2018-8065

JSON object : View

Products Affected

flexense

syncbreeze

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2018-8065", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-03-12T04:29:00.367", "references": [{"url": "http://packetstormsecurity.com/files/172676/Flexense-HTTP-Server-10.6.24-Buffer-Overflow-Denial-Of-Service.html", "source": "cve@mitre.org"}, {"url": "https://github.com/EgeBalci/Sync_Breeze_Enterprise_10_6_24_-DOS", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/rapid7/metasploit-framework/pull/9701", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/172676/Flexense-HTTP-Server-10.6.24-Buffer-Overflow-Denial-Of-Service.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/EgeBalci/Sync_Breeze_Enterprise_10_6_24_-DOS", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rapid7/metasploit-framework/pull/9701", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe memory region that can be triggered by rapidly sending a variety of HTTP requests with long HTTP header values or long URIs."}, {"lang": "es", "value": "Se ha descubierto un problema en el servidor web en Flexense SyncBreeze Enterprise 10.6.24. Hay una violaci\u00f3n de acceso de escritura del modo usuario en la regi\u00f3n de memoria syncbrs.exe que puede desencadenarse mediante el env\u00edo r\u00e1pidamente de peticiones HTTP con valores largos de cabecera HTTP o de URI."}], "lastModified": "2024-11-21T04:13:12.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flexense:syncbreeze:10.6.24:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "AE71FFE0-33A0-4EE7-8B38-11776DC166D6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}