Details of VAR-201112-0121

ID

VAR-201112-0121

CVE

CVE-2011-5033

TITLE

ConfigServer Firewall Buffer Overflow Vulnerability

Trust: 0.9

sources: BID: 51005 // CNNVD: CNNVD-201112-163

DESCRIPTION

Stack-based buffer overflow in CFS.c in ConfigServer Security & Firewall (CSF) before 5.43, when running on a DirectAdmin server, allows local users to cause a denial of service (crash) via a long string in an admin.list file. ConfigServer Firewall is prone to a buffer-overflow vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of the application using the vulnerable control. Failed exploit attempts will result in a denial-of-service condition

Trust: 2.07

sources: NVD: CVE-2011-5033 // JVNDB: JVNDB-2011-003590 // BID: 51005 // VULHUB: VHN-52978 // VULMON: CVE-2011-5033

AFFECTED PRODUCTS

vendor:	configserver	model:	security firewall	scope:	eq	version:	5.18	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.19	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.20	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.21	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.22	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.30	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.31	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.32	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.33	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.34	Trust: 1.7
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.00	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.01	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.02	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.03	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.04	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.05	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.06	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.07	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.08	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.09	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.10	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.11	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.12	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.13	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.14	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.15	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.16	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.17	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.35	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.36	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.37	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.38	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.39	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.40	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.41	Trust: 1.1
vendor:	configserver	model:	security firewall	scope:	lte	version:	5.42	Trust: 1.0
vendor:	configserver	model:	security & firewall	scope:	lt	version:	5.43	Trust: 0.8
vendor:	way	model:	to the web configserver firewall	scope:	eq	version:	0	Trust: 0.3
vendor:	configserver	model:	security firewall	scope:	eq	version:	5.42	Trust: 0.1

sources: VULMON: CVE-2011-5033 // BID: 51005 // JVNDB: JVNDB-2011-003590 // CNNVD: CNNVD-201112-487 // NVD: CVE-2011-5033

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2011-5033
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2011-5033
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201112-487
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-52978
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2011-5033
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2011-5033
severity:	MEDIUM
baseScore:	4.4
vectorString:	AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.4
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-52978
severity:	MEDIUM
baseScore:	4.4
vectorString:	AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.4
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-52978 // VULMON: CVE-2011-5033 // JVNDB: JVNDB-2011-003590 // CNNVD: CNNVD-201112-487 // NVD: CVE-2011-5033

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-52978 // JVNDB: JVNDB-2011-003590 // NVD: CVE-2011-5033

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201112-163

TYPE

buffer overflow

Trust: 1.2

sources: CNNVD: CNNVD-201112-163 // CNNVD: CNNVD-201112-487

CONFIGURATIONS

sources: JVNDB: JVNDB-2011-003590

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-52978 // VULMON: CVE-2011-5033

PATCH

title:	SOS CSF Firewall Buffer Overflow SOS	url:	http://forum.configserver.com/viewtopic.php?f=4&t=5008	Trust: 0.8
title:	changelog	url:	http://www.configserver.com/free/csf/changelog.txt	Trust: 0.8
title:	LinuxFlaw	url:	https://github.com/mudongliang/LinuxFlaw	Trust: 0.1
title:	cve-	url:	https://github.com/oneoy/cve-	Trust: 0.1

sources: VULMON: CVE-2011-5033 // JVNDB: JVNDB-2011-003590

EXTERNAL IDS

db:	NVD	id:	CVE-2011-5033	Trust: 2.9
db:	EXPLOIT-DB	id:	18225	Trust: 1.8
db:	BID	id:	51005	Trust: 1.1
db:	JVNDB	id:	JVNDB-2011-003590	Trust: 0.8
db:	CNNVD	id:	CNNVD-201112-487	Trust: 0.7
db:	CNNVD	id:	CNNVD-201112-163	Trust: 0.6
db:	XF	id:	71758	Trust: 0.6
db:	SEEBUG	id:	SSVID-72407	Trust: 0.1
db:	VULHUB	id:	VHN-52978	Trust: 0.1
db:	VULMON	id:	CVE-2011-5033	Trust: 0.1

sources: VULHUB: VHN-52978 // VULMON: CVE-2011-5033 // BID: 51005 // JVNDB: JVNDB-2011-003590 // CNNVD: CNNVD-201112-163 // CNNVD: CNNVD-201112-487 // NVD: CVE-2011-5033

REFERENCES

url:	http://www.configserver.com/free/csf/changelog.txt	Trust: 1.8
url:	http://www.exploit-db.com/exploits/18225	Trust: 1.8
url:	http://forum.configserver.com/viewtopic.php?f=4&t=5008	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/71758	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-5033	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-5033	Trust: 0.8
url:	http://www.securityfocus.com/bid/51005	Trust: 0.7
url:	http://xforce.iss.net/xforce/xfdb/71758	Trust: 0.6
url:	http://www.configserver.com/cp/csf.html	Trust: 0.3
url:	http://forum.configserver.com/viewtopic.php?f=4&t=5008	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.exploit-db.com/exploits/18225/	Trust: 0.1

sources: VULHUB: VHN-52978 // VULMON: CVE-2011-5033 // BID: 51005 // JVNDB: JVNDB-2011-003590 // CNNVD: CNNVD-201112-163 // CNNVD: CNNVD-201112-487 // NVD: CVE-2011-5033

CREDITS

FoX HaCkEr

Trust: 0.9

sources: BID: 51005 // CNNVD: CNNVD-201112-163

SOURCES

db:	VULHUB	id:	VHN-52978
db:	VULMON	id:	CVE-2011-5033
db:	BID	id:	51005
db:	JVNDB	id:	JVNDB-2011-003590
db:	CNNVD	id:	CNNVD-201112-163
db:	CNNVD	id:	CNNVD-201112-487
db:	NVD	id:	CVE-2011-5033

LAST UPDATE DATE

2024-08-14T15:03:52.261000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-52978	date:	2017-08-29T00:00:00
db:	VULMON	id:	CVE-2011-5033	date:	2017-08-29T00:00:00
db:	BID	id:	51005	date:	2012-01-03T22:10:00
db:	JVNDB	id:	JVNDB-2011-003590	date:	2012-01-05T00:00:00
db:	CNNVD	id:	CNNVD-201112-163	date:	2011-12-13T00:00:00
db:	CNNVD	id:	CNNVD-201112-487	date:	2012-01-06T00:00:00
db:	NVD	id:	CVE-2011-5033	date:	2017-08-29T01:30:39.177

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-52978	date:	2011-12-29T00:00:00
db:	VULMON	id:	CVE-2011-5033	date:	2011-12-29T00:00:00
db:	BID	id:	51005	date:	2011-12-09T00:00:00
db:	JVNDB	id:	JVNDB-2011-003590	date:	2012-01-05T00:00:00
db:	CNNVD	id:	CNNVD-201112-163	date:	1900-01-01T00:00:00
db:	CNNVD	id:	CNNVD-201112-487	date:	2011-12-30T00:00:00
db:	NVD	id:	CVE-2011-5033	date:	2011-12-29T22:55:02.030