Details of VAR-200411-0128

ID

VAR-200411-0128

CVE

CVE-2004-0331

TITLE

Dell OpenManage Web Server POST Request Heap Overflow Vulnerability

Trust: 0.9

sources: BID: 9750 // CNNVD: CNNVD-200411-104

DESCRIPTION

Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable. Dell's openmanage Exists in unspecified vulnerabilities.None. Dell OpenManage Web Server has been reported prone to a remote heap overflow vulnerability. The issue presents itself due to a lack of sufficient bounds checks performed on POST request data. A remote attacker may exploit this issue to corrupt heap based memory management structures located adjacent to the affected buffer

Trust: 1.98

sources: NVD: CVE-2004-0331 // JVNDB: JVNDB-2004-000834 // BID: 9750 // VULHUB: VHN-8761

AFFECTED PRODUCTS

vendor:	dell	model:	openmanage	scope:	eq	version:	3.7.1	Trust: 1.9
vendor:	dell	model:	openmanage	scope:	eq	version:	3.7	Trust: 1.9
vendor:	dell	model:	openmanage	scope:	eq	version:	3.4	Trust: 1.9
vendor:	dell	model:	openmanage	scope:	eq	version:	3.2	Trust: 1.9
vendor:	デル	model:	openmanage	scope:	eq	version:	-	Trust: 0.8
vendor:	デル	model:	openmanage	scope:	eq	version:	3.7	Trust: 0.8
vendor:	デル	model:	openmanage	scope:	eq	version:	3.4	Trust: 0.8
vendor:	デル	model:	openmanage	scope:	eq	version:	3.2	Trust: 0.8
vendor:	デル	model:	openmanage	scope:	-	version:	-	Trust: 0.8
vendor:	デル	model:	openmanage	scope:	eq	version:	3.7.1	Trust: 0.8

sources: BID: 9750 // JVNDB: JVNDB-2004-000834 // CNNVD: CNNVD-200411-104 // NVD: CVE-2004-0331

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2004-0331
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2004-0331
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200411-104
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-8761
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2004-0331
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-8761
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-8761 // JVNDB: JVNDB-2004-000834 // CNNVD: CNNVD-200411-104 // NVD: CVE-2004-0331

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	others (CWE-Other) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2004-000834 // NVD: CVE-2004-0331

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200411-104

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200411-104

EXTERNAL IDS

db:	NVD	id:	CVE-2004-0331	Trust: 3.6
db:	BID	id:	9750	Trust: 2.8
db:	JVNDB	id:	JVNDB-2004-000834	Trust: 0.8
db:	CNNVD	id:	CNNVD-200411-104	Trust: 0.7
db:	XF	id:	15325	Trust: 0.6
db:	BUGTRAQ	id:	20040226 DELL OPENMANAGE WEB SERVER HEAP OVERFLOW (PRE-AUTH)	Trust: 0.6
db:	VULHUB	id:	VHN-8761	Trust: 0.1

sources: VULHUB: VHN-8761 // BID: 9750 // JVNDB: JVNDB-2004-000834 // CNNVD: CNNVD-200411-104 // NVD: CVE-2004-0331

REFERENCES

url:	http://sh0dan.org/files/domadv.txt	Trust: 2.8
url:	http://www.securityfocus.com/bid/9750	Trust: 2.5
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/15325	Trust: 1.9
url:	http://marc.info/?l=bugtraq&m=107781539829143&w=2	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2004-0331	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/15325	Trust: 0.6
url:	http://marc.theaimsgroup.com/?l=bugtraq&m=107781539829143&w=2	Trust: 0.6
url:	http://support.dell.com/filelib/format.aspx?releaseid=r74030	Trust: 0.3
url:	http://support.dell.com/filelib/format.aspx?releaseid=r74031	Trust: 0.3
url:	http://support.dell.com/filelib/format.aspx?releaseid=r74029	Trust: 0.3
url:	http://support.dell.com/filelib/download.aspx?fileid=96563&c=us&l=en&s=dhs&category=36&os=wnt5&osl=en&svctag=&sysid=pwe_fos_xeo_6650&deviceid=2954&type=&releaseid=r74029	Trust: 0.3
url:	http://www.dell.com/	Trust: 0.3
url:	/archive/1/355374	Trust: 0.3
url:	http://marc.info/?l=bugtraq&m=107781539829143&w=2	Trust: 0.1

sources: VULHUB: VHN-8761 // BID: 9750 // JVNDB: JVNDB-2004-000834 // CNNVD: CNNVD-200411-104 // NVD: CVE-2004-0331

CREDITS

Discovery of this vulnerability has been credited to "wirepair" <wirepair@roguemail.net>.

Trust: 0.9

sources: BID: 9750 // CNNVD: CNNVD-200411-104

SOURCES

db:	VULHUB	id:	VHN-8761
db:	BID	id:	9750
db:	JVNDB	id:	JVNDB-2004-000834
db:	CNNVD	id:	CNNVD-200411-104
db:	NVD	id:	CVE-2004-0331

LAST UPDATE DATE

2024-08-14T15:36:07.176000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-8761	date:	2017-07-11T00:00:00
db:	BID	id:	9750	date:	2009-07-12T03:06:00
db:	JVNDB	id:	JVNDB-2004-000834	date:	2024-06-03T09:35:00
db:	CNNVD	id:	CNNVD-200411-104	date:	2005-10-20T00:00:00
db:	NVD	id:	CVE-2004-0331	date:	2017-07-11T01:30:04.620

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-8761	date:	2004-11-23T00:00:00
db:	BID	id:	9750	date:	2004-02-26T00:00:00
db:	JVNDB	id:	JVNDB-2004-000834	date:	2024-06-03T00:00:00
db:	CNNVD	id:	CNNVD-200411-104	date:	2004-11-23T00:00:00
db:	NVD	id:	CVE-2004-0331	date:	2004-11-23T05:00:00