CVE-2019-3955

{"id": "CVE-2019-3955", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-06-07T20:29:01.467", "references": [{"url": "https://www.tenable.com/security/research/tra-2019-26", "tags": ["Exploit", "Third Party Advisory"], "source": "vulnreport@tenable.com"}, {"url": "https://www.tenable.com/security/research/tra-2019-26", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen during key negotiation. An unauthenticated remote attacker can cause a heap buffer overflow by specifying a large RsaPubKeyLen, which could cause a denial of service."}, {"lang": "es", "value": "Dameware Remote Mini Control versi\u00f3n 12.1.0.34 y anterior, contiene un desbordamiento remoto de pila no autenticado, debido a que el servidor no est\u00e1 comprobando correctamente RsaPubKeyLen durante la negociaci\u00f3n de la clave. Un atacante remoto no autenticado puede causar un desbordamiento de b\u00fafer de la pila especificando un par\u00e1metro largo RsaPubKeyLen, lo que podr\u00eda causar una denegaci\u00f3n de servicio."}], "lastModified": "2024-11-21T04:42:56.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dameware:remote_mini_control:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88EFD339-8C6D-43F7-84E1-84626579BE25", "versionEndIncluding": "12.1.0.34"}], "operator": "OR"}]}], "sourceIdentifier": "vulnreport@tenable.com"}