Details of VAR-201406-0071

ID

VAR-201406-0071

CVE

CVE-2013-5017

TITLE

Symantec Web Gateway Management console SNMPConfig.php Vulnerable to arbitrary command execution

Trust: 0.8

sources: JVNDB: JVNDB-2013-006598

DESCRIPTION

SNMPConfig.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote attackers to execute arbitrary commands via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-77: Improper Neutralization of Special Elements used in a Command ( Command injection ) Has been identified. http://cwe.mitre.org/data/definitions/77.htmlAn arbitrary command may be executed by a third party. Authentication is required to exploit this vulnerability.The specific flaws exist within the user.php and snmpConfig.php files. SQL injection and command injection is possible through vulnerable request parameters. An attacker can leverage these vulnerabilities to read files and achieve remote code execution under the context of the root user. Successful exploits will result in the execution of arbitrary commands with elevated privileges in the context of the affected appliance. The software provides web content filtering, data loss prevention, and more

Trust: 2.61

sources: NVD: CVE-2013-5017 // JVNDB: JVNDB-2013-006598 // ZDI: ZDI-14-211 // BID: 67752 // VULHUB: VHN-65019

AFFECTED PRODUCTS

vendor:	symantec	model:	web gateway	scope:	lte	version:	5.2	Trust: 1.0
vendor:	symantec	model:	web gateway	scope:	lt	version:	5.2.1	Trust: 0.8
vendor:	symantec	model:	web gateway	scope:	-	version:	-	Trust: 0.7
vendor:	symantec	model:	web gateway	scope:	eq	version:	5.2	Trust: 0.6

sources: ZDI: ZDI-14-211 // JVNDB: JVNDB-2013-006598 // CNNVD: CNNVD-201406-427 // NVD: CVE-2013-5017

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-5017
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2013-5017
value:	HIGH
Trust: 0.8
ZDI:	CVE-2013-5017
value:	HIGH
Trust: 0.7
CNNVD:	CNNVD-201406-427
value:	HIGH
Trust: 0.6
VULHUB:	VHN-65019
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2013-5017
severity:	HIGH
baseScore:	7.9
vectorString:	AV:A/AC:M/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	5.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
ZDI:	CVE-2013-5017
severity:	HIGH
baseScore:	7.9
vectorString:	AV:N/AC:M/AU:S/C:C/I:C/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	9.2
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.7
VULHUB:	VHN-65019
severity:	HIGH
baseScore:	7.9
vectorString:	AV:A/AC:M/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	5.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2013-5017
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.0

sources: ZDI: ZDI-14-211 // VULHUB: VHN-65019 // JVNDB: JVNDB-2013-006598 // CNNVD: CNNVD-201406-427 // NVD: CVE-2013-5017

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2013-006598 // NVD: CVE-2013-5017

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201406-427

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201406-427

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-006598

PATCH

title:	SYM14-010	url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00	Trust: 0.8
title:	SYM14-010	url:	http://www.symantec.com/ja/jp/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140616_00	Trust: 0.8
title:	Symantec has issued an update to correct this vulnerability.	url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140616_00	Trust: 0.7

sources: ZDI: ZDI-14-211 // JVNDB: JVNDB-2013-006598

EXTERNAL IDS

db:	NVD	id:	CVE-2013-5017	Trust: 3.5
db:	BID	id:	67752	Trust: 2.0
db:	SECTRACK	id:	1030443	Trust: 1.1
db:	JVNDB	id:	JVNDB-2013-006598	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-2047	Trust: 0.7
db:	ZDI	id:	ZDI-14-211	Trust: 0.7
db:	CNNVD	id:	CNNVD-201406-427	Trust: 0.7
db:	VULHUB	id:	VHN-65019	Trust: 0.1

sources: ZDI: ZDI-14-211 // VULHUB: VHN-65019 // BID: 67752 // JVNDB: JVNDB-2013-006598 // CNNVD: CNNVD-201406-427 // NVD: CVE-2013-5017

REFERENCES

url:	http://www.securityfocus.com/bid/67752	Trust: 1.7
url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00	Trust: 1.6
url:	http://www.securitytracker.com/id/1030443	Trust: 1.1
url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5017	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-5017	Trust: 0.8
url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140616_00	Trust: 0.7
url:	http://www.symantec.com/business/web-gateway	Trust: 0.3
url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00	Trust: 0.1
url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00	Trust: 0.1

sources: ZDI: ZDI-14-211 // VULHUB: VHN-65019 // BID: 67752 // JVNDB: JVNDB-2013-006598 // CNNVD: CNNVD-201406-427 // NVD: CVE-2013-5017

CREDITS

Brandon Perry

Trust: 0.7

sources: ZDI: ZDI-14-211

SOURCES

db:	ZDI	id:	ZDI-14-211
db:	VULHUB	id:	VHN-65019
db:	BID	id:	67752
db:	JVNDB	id:	JVNDB-2013-006598
db:	CNNVD	id:	CNNVD-201406-427
db:	NVD	id:	CVE-2013-5017

LAST UPDATE DATE

2024-11-23T21:45:09.911000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-14-211	date:	2014-06-18T00:00:00
db:	VULHUB	id:	VHN-65019	date:	2017-12-28T00:00:00
db:	BID	id:	67752	date:	2014-06-18T17:45:00
db:	JVNDB	id:	JVNDB-2013-006598	date:	2014-06-23T00:00:00
db:	CNNVD	id:	CNNVD-201406-427	date:	2014-06-20T00:00:00
db:	NVD	id:	CVE-2013-5017	date:	2024-11-21T01:56:54.350

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-14-211	date:	2014-06-18T00:00:00
db:	VULHUB	id:	VHN-65019	date:	2014-06-18T00:00:00
db:	BID	id:	67752	date:	2014-06-16T00:00:00
db:	JVNDB	id:	JVNDB-2013-006598	date:	2014-06-23T00:00:00
db:	CNNVD	id:	CNNVD-201406-427	date:	2014-06-20T00:00:00
db:	NVD	id:	CVE-2013-5017	date:	2014-06-18T19:55:04.420