Details of VAR-200912-0357

ID

VAR-200912-0357

CVE

CVE-2009-4480

TITLE

AzeoTech DAQFactory of Web Service buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2009-004002

DESCRIPTION

Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.16 through 8.11. NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. AzeoTech DAQFactory is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Failed attacks will cause denial-of-service conditions. DAQFactory 5.77 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: DAQFactory Web Service Unspecified Buffer Overflow SECUNIA ADVISORY ID: SA36504 VERIFY ADVISORY: http://secunia.com/advisories/36504/ DESCRIPTION: A vulnerability has been reported in DAQFactory, which can be exploited by malicious people to compromise a vulnerable system. Successful exploitation may allow execution of arbitrary code. The vulnerability is reported in version 5.77. SOLUTION: Disable the web service if not required or restrict access to it. PROVIDED AND/OR DISCOVERED BY: Reportedly a module for VulnDisco Pack. ORIGINAL ADVISORY: http://intevydis.com/vd-list.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.98

sources: NVD: CVE-2009-4480 // JVNDB: JVNDB-2009-004002 // BID: 42001 // PACKETSTORM: 80989

AFFECTED PRODUCTS

vendor:

azeotech

model:

daqfactory

scope:

version:

5.77

Trust: 2.4

sources: JVNDB: JVNDB-2009-004002 // CNNVD: CNNVD-200912-421 // NVD: CVE-2009-4480

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2009-4480
value:	HIGH
Trust: 1.0
NVD:	CVE-2009-4480
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200912-421
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2009-4480
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

sources: JVNDB: JVNDB-2009-004002 // CNNVD: CNNVD-200912-421 // NVD: CVE-2009-4480

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2009-004002 // NVD: CVE-2009-4480

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200912-421

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200912-421

CONFIGURATIONS

sources: JVNDB: JVNDB-2009-004002

PATCH

title:

Top Page

url:

http://www.azeotech.com/index.php

Trust: 0.8

sources: JVNDB: JVNDB-2009-004002

EXTERNAL IDS

db:	NVD	id:	CVE-2009-4480	Trust: 2.7
db:	SECUNIA	id:	36504	Trust: 1.7
db:	JVNDB	id:	JVNDB-2009-004002	Trust: 0.8
db:	CNNVD	id:	CNNVD-200912-421	Trust: 0.6
db:	BID	id:	42001	Trust: 0.3
db:	PACKETSTORM	id:	80989	Trust: 0.1

sources: BID: 42001 // JVNDB: JVNDB-2009-004002 // PACKETSTORM: 80989 // CNNVD: CNNVD-200912-421 // NVD: CVE-2009-4480

REFERENCES

url:	http://secunia.com/advisories/36504	Trust: 1.6
url:	http://intevydis.com/vd-list.shtml	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4480	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4480	Trust: 0.8
url:	http://www.azeotech.com/index.php	Trust: 0.3
url:	http://secunia.com/advisories/36504/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/advisories/business_solutions/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: BID: 42001 // JVNDB: JVNDB-2009-004002 // PACKETSTORM: 80989 // CNNVD: CNNVD-200912-421 // NVD: CVE-2009-4480

CREDITS

unknown

Trust: 0.3

sources: BID: 42001

SOURCES

db:	BID	id:	42001
db:	JVNDB	id:	JVNDB-2009-004002
db:	PACKETSTORM	id:	80989
db:	CNNVD	id:	CNNVD-200912-421
db:	NVD	id:	CVE-2009-4480

LAST UPDATE DATE

2025-04-10T23:00:22.192000+00:00

SOURCES UPDATE DATE

db:	BID	id:	42001	date:	2009-09-03T00:00:00
db:	JVNDB	id:	JVNDB-2009-004002	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200912-421	date:	2009-12-31T00:00:00
db:	NVD	id:	CVE-2009-4480	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	BID	id:	42001	date:	2009-09-03T00:00:00
db:	JVNDB	id:	JVNDB-2009-004002	date:	2012-06-26T00:00:00
db:	PACKETSTORM	id:	80989	date:	2009-09-04T09:53:50
db:	CNNVD	id:	CNNVD-200912-421	date:	2009-12-30T00:00:00
db:	NVD	id:	CVE-2009-4480	date:	2009-12-30T21:30:00.453