CVE-2002-0066

Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control, which allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://razor.bindview.com/publish/advisories/adv_FunkProxy.html	Patch Vendor Advisory
http://www.iss.net/security_center/static/8793.php
http://www.securityfocus.com/bid/4460

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bindview:netrc:1.0:::::::*
	cpe:2.3:a:bindview:netrc:3.06:::::::*
	cpe:2.3:a:funk_software:funk_software_proxy:3.0:::::::*
	cpe:2.3:a:funk_software:funk_software_proxy:3.06:::::::*
	cpe:2.3:a:funk_software:funk_software_proxy:3.09:::::::*

History

No history.

Information

Published : 2002-04-22 04:00

Updated : 2024-02-04 16:31

NVD link : CVE-2002-0066

Mitre link : CVE-2002-0066

CVE.ORG link : CVE-2002-0066

JSON object : View

Products Affected

funk_software

funk_software_proxy

bindview

netrc

CWE

NVD-CWE-Other

{"id": "CVE-2002-0066", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2002-04-22T04:00:00.000", "references": [{"url": "http://razor.bindview.com/publish/advisories/adv_FunkProxy.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/8793.php", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/4460", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access control, which allows local and possibly remote users to use the Proxy Host's configuration utilities and gain privileges."}, {"lang": "es", "value": "Funk Software Proxy Host 3.x anterior a 3.09a crea un tuber\u00eda con nombre (Named Pipe) que no requiere autentificaci\u00f3n y se instala con control de acceso inseguro, lo que permite a usuarios locales y posiblemente remotos usar las utilidades de configuraci\u00f3n del Proxy Host y ganar privilegios."}], "lastModified": "2008-09-10T19:11:14.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bindview:netrc:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "760DB974-6B4A-4A09-9B4F-201456DE9136"}, {"criteria": "cpe:2.3:a:bindview:netrc:3.06:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD26D34A-F8C0-4C74-A825-6B59DA0C12D8"}, {"criteria": "cpe:2.3:a:funk_software:funk_software_proxy:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ECA01B9-A163-4069-8CBA-C6D019B4DB66"}, {"criteria": "cpe:2.3:a:funk_software:funk_software_proxy:3.06:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4F701BB-4525-42A7-80AF-51D127A836B5"}, {"criteria": "cpe:2.3:a:funk_software:funk_software_proxy:3.09:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC126FFF-687F-41AA-BC77-E577D05B4BB8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}