CVE-2014-6119

IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote attackers to execute arbitrary code via a crafted executable file in an archive.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21693035	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21693183
http://www.securitytracker.com/id/1031427
http://secunia.com/advisories/62012
https://exchange.xforce.ibmcloud.com/vulnerabilities/96720

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:security_appscan:8.6::::enterprise:::
	cpe:2.3:a:ibm:security_appscan:8.7::::enterprise:::
	cpe:2.3:a:ibm:security_appscan:8.8::::enterprise:::
	cpe:2.3:a:ibm:security_appscan:9.0::::enterprise:::
	cpe:2.3:a:ibm:security_appscan:8.5::::enterprise:::
	cpe:2.3:a:ibm:security_appscan:9.0.0.1::::enterprise:::
	cpe:2.3:a:ibm:security_appscan_source:9.0.1::::enterprise:::

Information

Published : 2014-12-23 02:59

Updated : 2017-09-08 01:29

NVD link : CVE-2014-6119

Mitre link : CVE-2014-6119

JSON object : View

Products Affected

ibm

security_appscan_source
security_appscan

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21693035", "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21693035", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21693183", "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21693183", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securitytracker.com/id/1031427", "name": "1031427", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/62012", "name": "62012", "tags": [], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96720", "name": "ibm-appscan-cve20146119-archive(96720)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote attackers to execute arbitrary code via a crafted executable file in an archive."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-94"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-6119", "ASSIGNER": "psirt@us.ibm.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-12-23T02:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:security_appscan:8.6:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:security_appscan:8.7:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:security_appscan:8.8:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:security_appscan:9.0:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:security_appscan:8.5:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:security_appscan:9.0.0.1:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:security_appscan_source:9.0.1:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-09-08T01:29Z"}