Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Mutiny Technology virtual appliance command injection vulnerability
Informations
Name VU#841851 First vendor Publication 2012-10-22
Vendor VU-CERT Last vendor Modification 2012-10-22
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Cvss Base Score 8.5 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 6.8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#841851

Mutiny Technology virtual appliance command injection vulnerability

Original Release date: 22 Oct 2012 | Last revised: 22 Oct 2012

Overview

The Mutiny Technology virtual appliance contains a command injection vulnerability which could allow an attacker to inject commands into the appliance.

Description

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

The Mutiny Technology virtual appliance contains a network interface menu which is vulnerable to command injection with root privileges.

Impact

An authenticated attacker can run arbitrary commands on the appliance.

Solution

Update

The vendor has stated that this vulnerability has been addressed in Mutiny Technology virtual appliance version 4.5-1.12. Users are advised to upgrade to Mutiny Technology virtual appliance version 4.5-1.12 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Restricting access would prevent an attacker from accessing a Mutiny Technology virtual appliance using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Mutiny TechnologiesAffected09 Aug 201209 Oct 2012
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base2.1AV:N/AC:H/Au:S/C:N/I:P/A:N
Temporal1.4E:U/RL:OF/RC:UC
Environmental0.6CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

  • http://cwe.mitre.org/data/definitions/77.html
  • http://www.mutiny.com/releasehistory.php

Credit

Thanks to Christopher Campbell for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

  • CVE IDs:CVE-2012-3001
  • Date Public:07 Oct 2012
  • Date First Published:22 Oct 2012
  • Date Last Updated:22 Oct 2012
  • Document Revision:8

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

This product is provided subject to the Notification as indicated here: http://www.us-cert.gov/legal.html#notify

Original Source

Url : http://www.kb.cert.org/vuls/id/841851

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-78 Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 4

OpenVAS Exploits

Date Description
2012-10-23 Name : Mutiny Command Injection Vulnerability
File : nvt/gb_mutiny_56165.nasl

Metasploit Database

id Description
2012-10-22 Mutiny Remote Command Execution

Nessus® Vulnerability Scanner

Date Description
2012-10-26 Name : The remote host contains a network monitoring application that is affected by...
File : mutiny_4_5_1_12.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
Date Informations
2020-05-23 13:17:16
  • Multiple Updates
2016-03-03 05:24:35
  • Multiple Updates
2016-03-03 00:21:12
  • Multiple Updates
2014-02-17 12:08:12
  • Multiple Updates
2013-07-30 05:21:05
  • Multiple Updates
2013-07-05 10:07:27
  • Multiple Updates