Details of VAR-201905-1120

ID

VAR-201905-1120

CVE

CVE-2018-19978

TITLE

Auerswald COMfort 1200 IP phone Buffer error vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2018-015554 // CNNVD: CNNVD-201905-1083

DESCRIPTION

A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a remote attacker (authenticated as simple user in the same network as the device) to trigger remote code execution via a POST request (ManufacturerName parameter) to the web server on the device. The web server is running with root privileges and the injected code will also run with root privileges. Auerswald COMfort 1200 IP phone Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Auerswald COMfort 1200 IP phone is an IP phone produced by German Auerswald company. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc

Trust: 1.71

sources: NVD: CVE-2018-19978 // JVNDB: JVNDB-2018-015554 // VULHUB: VHN-130691

AFFECTED PRODUCTS

vendor:	auerswald	model:	comfortel 1200 ip	scope:	eq	version:	3.4.4.1-10589	Trust: 1.0
vendor:	auerswald	model:	comfort 1200 ip	scope:	eq	version:	3.4.4.1-10589	Trust: 0.8

sources: JVNDB: JVNDB-2018-015554 // NVD: CVE-2018-19978

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-19978
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-19978
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201905-1083
value:	HIGH
Trust: 0.6
VULHUB:	VHN-130691
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-19978
severity:	HIGH
baseScore:	7.7
vectorString:	AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	5.1
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-130691
severity:	HIGH
baseScore:	7.7
vectorString:	AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	5.1
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-19978
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.1
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-130691 // JVNDB: JVNDB-2018-015554 // CNNVD: CNNVD-201905-1083 // NVD: CVE-2018-19978

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-130691 // JVNDB: JVNDB-2018-015554 // NVD: CVE-2018-19978

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201905-1083

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201905-1083

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-015554

PATCH

title:

COMfortel 1200 IP

url:

https://www.auerswald.de/de/service/81-telefone/schnurgebundene-telefone/1568-comfortel-1200-ip.html

Trust: 0.8

sources: JVNDB: JVNDB-2018-015554

EXTERNAL IDS

db:	NVD	id:	CVE-2018-19978	Trust: 2.5
db:	JVNDB	id:	JVNDB-2018-015554	Trust: 0.8
db:	CNNVD	id:	CNNVD-201905-1083	Trust: 0.7
db:	VULHUB	id:	VHN-130691	Trust: 0.1

sources: VULHUB: VHN-130691 // JVNDB: JVNDB-2018-015554 // CNNVD: CNNVD-201905-1083 // NVD: CVE-2018-19978

REFERENCES

url:	https://www.sit.fraunhofer.de/fileadmin/dokumente/cve/advisory_auerswald_comfortel_1200_ip.pdf?_=1549376183	Trust: 2.5
url:	https://www.auerswald.de/de/service/81-telefone/schnurgebundene-telefone/1568-comfortel-1200-ip.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2018-19978	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-19978	Trust: 0.8

sources: VULHUB: VHN-130691 // JVNDB: JVNDB-2018-015554 // CNNVD: CNNVD-201905-1083 // NVD: CVE-2018-19978

SOURCES

db:	VULHUB	id:	VHN-130691
db:	JVNDB	id:	JVNDB-2018-015554
db:	CNNVD	id:	CNNVD-201905-1083
db:	NVD	id:	CVE-2018-19978

LAST UPDATE DATE

2024-11-23T22:58:40.134000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-130691	date:	2019-05-30T00:00:00
db:	JVNDB	id:	JVNDB-2018-015554	date:	2019-06-12T00:00:00
db:	CNNVD	id:	CNNVD-201905-1083	date:	2019-05-31T00:00:00
db:	NVD	id:	CVE-2018-19978	date:	2024-11-21T03:58:55.797

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-130691	date:	2019-05-29T00:00:00
db:	JVNDB	id:	JVNDB-2018-015554	date:	2019-06-12T00:00:00
db:	CNNVD	id:	CNNVD-201905-1083	date:	2019-05-29T00:00:00
db:	NVD	id:	CVE-2018-19978	date:	2019-05-29T18:29:00.960