Dell Kace K2000 Multiple Remote Security Vulnerabilities
BID:50605
Info
Dell Kace K2000 Multiple Remote Security Vulnerabilities
| Bugtraq ID: | 50605 |
| Class: | Unknown |
| CVE: |
CVE-2011-4046 CVE-2011-4047 CVE-2011-4048 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2011 12:00AM |
| Updated: | Nov 08 2011 12:00AM |
| Credit: | Tenable Network Security |
| Vulnerable: |
Dell Kace K2000 0 |
| Not Vulnerable: | |
Discussion
Dell Kace K2000 Multiple Remote Security Vulnerabilities
Dell Kace K2000 is prone to multiple remote vulnerabilities including an information-disclosure issue, a backdoor issue, multiple cross-site scripting issues and a remote command-execution issue.
An attacker can exploit these issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials, gain access to sensitive information, or execute arbitrary commands with root privileges. Other attacks may also be possible.
Dell Kace K2000 is prone to multiple remote vulnerabilities including an information-disclosure issue, a backdoor issue, multiple cross-site scripting issues and a remote command-execution issue.
An attacker can exploit these issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials, gain access to sensitive information, or execute arbitrary commands with root privileges. Other attacks may also be possible.
Exploit / POC
Dell Kace K2000 Multiple Remote Security Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Dell Kace K2000 Multiple Remote Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Dell Kace K2000 Multiple Remote Security Vulnerabilities
References:
References:
- Dell Homepage (Dell)
- Dell KACE K2000 Appliance contains backdoor administrator account (US-CERT)
- Dell KACE K2000 Appliance contains multiple reflected cross-site scripting vulne (US-CERT)
- Dell KACE K2000 Appliance database administration account allows arbitrary comma (US-CERT)
- Dell KACE K2000 Appliance read-only database account allows account information (US-CERT)