CVE-2017-2785

An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit.

CVSS v3 10.0 CRITICAL
CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/96742
http://www.talosintelligence.com/reports/TALOS-2017-0280/	Technical Description Third Party Advisory
http://www.securityfocus.com/bid/96742
http://www.talosintelligence.com/reports/TALOS-2017-0280/	Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pharos:popup:9.0:*:*:*:*:*:*:*

History

21 Nov 2024, 03:24

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/96742 -~~	() http://www.securityfocus.com/bid/96742 -
References	~~() http://www.talosintelligence.com/reports/TALOS-2017-0280/ - Technical Description, Third Party Advisory~~	() http://www.talosintelligence.com/reports/TALOS-2017-0280/ - Technical Description, Third Party Advisory

Information

Published : 2017-03-10 10:59

Updated : 2024-11-21 03:24

NVD link : CVE-2017-2785

Mitre link : CVE-2017-2785

CVE.ORG link : CVE-2017-2785

JSON object : View

Products Affected

pharos

popup

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2017-2785", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2017-03-10T10:59:00.217", "references": [{"url": "http://www.securityfocus.com/bid/96742", "source": "talos-cna@cisco.com"}, {"url": "http://www.talosintelligence.com/reports/TALOS-2017-0280/", "tags": ["Technical Description", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "http://www.securityfocus.com/bid/96742", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.talosintelligence.com/reports/TALOS-2017-0280/", "tags": ["Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit."}, {"lang": "es", "value": "Existe una vulnerabilidad explotable de desbordamiento de b\u00fafer en la aplicaci\u00f3n psnotifyd del cliente de impresora Pharos PopUp versi\u00f3n 9.0. Un paquete especialmente manipulado puede ser enviado al ordenador de la v\u00edctima y puede conducir a un desbordamiento de b\u00fafer basado en memoria din\u00e1mica resultando en una ejecuci\u00f3n remota de c\u00f3digo. Este cliente siempre est\u00e1 escuchando, tiene privilegios de root y no requiere la interacci\u00f3n de usuario para explotarla."}], "lastModified": "2024-11-21T03:24:08.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pharos:popup:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E5ADB81-A7B4-4143-B69D-15C8CB24FA4B"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}