{"id": "CVE-2003-1287", "bulletinFamily": "NVD", "title": "CVE-2003-1287", "description": "Sambar Server before 6.0 beta 3 allows attackers with physical access to execute arbitrary code via a request with an MS-DOS device name such as com1.pl, con.pl, or aux.pl, which causes Perl to read the code from the associated device.", "published": "2003-12-31T00:00:00", "modified": "2017-07-10T21:29:51", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-1287", "reporter": "NVD", "references": ["http://www.sambar.com/security.htm", "http://www.idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=true", "http://archives.neohapsis.com/archives/bugtraq/2004-04/0353.html", "https://exchange.xforce.ibmcloud.com/vulnerabilities/16059", "http://securitytracker.com/id?1007819"], "cvelist": ["CVE-2003-1287"], "type": "cve", "lastseen": "2017-07-11T11:14:21", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:sambar:sambar_server:5.1:beta2", "cpe:/a:sambar:sambar_server:5.1:beta1", "cpe:/a:sambar:sambar_server:5.0:beta4", "cpe:/a:sambar:sambar_server:5.2", "cpe:/a:sambar:sambar_server:5.0:beta3", "cpe:/a:sambar:sambar_server:6.0:beta2", "cpe:/a:sambar:sambar_server:5.1:beta3", "cpe:/a:sambar:sambar_server:5.1", "cpe:/a:sambar:sambar_server:5.0:beta5", "cpe:/a:sambar:sambar_server:5.3", "cpe:/a:sambar:sambar_server:5.0:beta1", "cpe:/a:sambar:sambar_server:5.1:beta5", "cpe:/a:sambar:sambar_server:5.0", "cpe:/a:sambar:sambar_server:5.0:beta2", "cpe:/a:sambar:sambar_server:5.1:beta4", "cpe:/a:sambar:sambar_server:5.0:beta6", "cpe:/a:sambar:sambar_server:6.0:beta1"], "cvelist": ["CVE-2003-1287"], "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Sambar Server before 6.0 beta 3 allows attackers with physical access to execute arbitrary code via a request with an MS-DOS device name such as com1.pl, con.pl, or aux.pl, which causes Perl to read the code from the associated device.", "edition": 1, "enchantments": {}, "hash": "ff8f26fb1b1969f85734e3672b825268dedef7ecddc693cefb58a622349de12d", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "5f92ee7472936c7e80c176c7accdedc8", "key": "modified"}, {"hash": "a2a2213fafdcc02c66ce0df2e6f44d78", "key": "description"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "43a0f03895584fd10189028b6173a16d", "key": "href"}, {"hash": "10905ab5b16ffe1c3c9681d43d8d991d", "key": "references"}, {"hash": "daf44002a79eca84eab25816dedf9ba6", "key": "cpe"}, {"hash": "a7df60f5f1d475f1fcad868f50b4b831", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "292f2e293571b0e70e3182b615982dad", "key": "cvss"}, {"hash": "6234d12743224fec9a8565c6c6f68733", "key": "cvelist"}, {"hash": "0be64788bbc43a0f889dacf4d60da270", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-1287", "id": "CVE-2003-1287", "lastseen": "2016-09-03T04:11:44", "modified": "2008-09-05T16:36:32", "objectVersion": "1.2", "published": "2003-12-31T00:00:00", "references": ["http://www.sambar.com/security.htm", "http://xforce.iss.net/xforce/xfdb/16059", "http://www.idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=true", "http://archives.neohapsis.com/archives/bugtraq/2004-04/0353.html", "http://securitytracker.com/id?1007819"], "reporter": "NVD", "scanner": [], "title": "CVE-2003-1287", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T04:11:44"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "daf44002a79eca84eab25816dedf9ba6"}, {"key": "cvelist", "hash": "6234d12743224fec9a8565c6c6f68733"}, {"key": "cvss", "hash": "292f2e293571b0e70e3182b615982dad"}, {"key": "description", "hash": "a2a2213fafdcc02c66ce0df2e6f44d78"}, {"key": "href", "hash": "43a0f03895584fd10189028b6173a16d"}, {"key": "modified", "hash": "c5cf7a3bc1a4dab1d96892eee6e86ad9"}, {"key": "published", "hash": "0be64788bbc43a0f889dacf4d60da270"}, {"key": "references", "hash": "068812effd76b2500e658edac8446ffb"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "a7df60f5f1d475f1fcad868f50b4b831"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "b7750c2521eb94013bdbf11b13049afc7f1bd6745054b314b79bbad63a6f9b1c", "viewCount": 1, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-07-11T11:14:21"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:sambar:sambar_server:5.1:beta2", "cpe:/a:sambar:sambar_server:5.1:beta1", "cpe:/a:sambar:sambar_server:5.0:beta4", "cpe:/a:sambar:sambar_server:5.2", "cpe:/a:sambar:sambar_server:5.0:beta3", "cpe:/a:sambar:sambar_server:6.0:beta2", "cpe:/a:sambar:sambar_server:5.1:beta3", "cpe:/a:sambar:sambar_server:5.1", "cpe:/a:sambar:sambar_server:5.0:beta5", "cpe:/a:sambar:sambar_server:5.3", "cpe:/a:sambar:sambar_server:5.0:beta1", "cpe:/a:sambar:sambar_server:5.1:beta5", "cpe:/a:sambar:sambar_server:5.0", "cpe:/a:sambar:sambar_server:5.0:beta2", "cpe:/a:sambar:sambar_server:5.1:beta4", "cpe:/a:sambar:sambar_server:5.0:beta6", "cpe:/a:sambar:sambar_server:6.0:beta1"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"osvdb": [{"lastseen": "2017-04-28T13:20:00", "references": [], "edition": 1, "description": "## Vulnerability Description\nSambar Server contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when a specially-crafted request containing a valid device name is sent to the server. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.\n## Solution Description\nUpgrade to version 6.0 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nSambar Server contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered when a specially-crafted request containing a valid device name is sent to the server. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.\n## Manual Testing Notes\nPOST /cgi-bin/com1.pl HTTP/1.0\n\nThe above request will initiate the Perl interpreter (perl.exe) to process code from the COM1 port. An attacker can supply code to the interpreter by connecting to the target system through a null-modem cable with a terminal application.\n## References:\n[Vendor Specific Advisory URL](http://www.sambar.com/security.htm)\nSecurity Tracker: 1007819\n[Secunia Advisory ID:9578](https://secuniaresearch.flexerasoftware.com/advisories/9578/)\n[Related OSVDB ID: 5780](https://vulners.com/osvdb/OSVDB:5780)\n[Related OSVDB ID: 5785](https://vulners.com/osvdb/OSVDB:5785)\n[Related OSVDB ID: 5782](https://vulners.com/osvdb/OSVDB:5782)\n[Related OSVDB ID: 5783](https://vulners.com/osvdb/OSVDB:5783)\n[Related OSVDB ID: 5784](https://vulners.com/osvdb/OSVDB:5784)\n[Related OSVDB ID: 5786](https://vulners.com/osvdb/OSVDB:5786)\nOther Advisory URL: http://www.idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=true\nMail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=108335071417386&w=2\nISS X-Force ID: 13305\n[CVE-2003-1287](https://vulners.com/cve/CVE-2003-1287)\n", "reporter": "3apa3a(3APA3A@security.nnov.ru)", "published": "2003-09-25T05:43:49", "title": "Sambar Server DOS Device Name Code Execution", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Sambar Server", "version": "5.1", "operator": "eq"}, {"name": "Sambar Server", "version": "5.0", "operator": "eq"}, {"name": "Sambar Server", "version": "5.3", "operator": "eq"}, {"name": "Sambar Server", "version": "5.2", "operator": "eq"}], "cvelist": ["CVE-2003-1287"], "modified": "2003-09-25T05:43:49", "href": "https://vulners.com/osvdb/OSVDB:5781", "id": "OSVDB:5781", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}