Lucene search

[email protected]CVE-2012-5003

HistorySep 19, 2012 - 9:55 p.m.

CVE-2012-5003

2012-09-1921:55:04

CWE-287

[email protected]

web.nvd.nist.gov

cve-2012-5003

no machine

nx web companion

rce

security vulnerability

update verification

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

AI Score

Confidence

High

0.054 Low

EPSS

Percentile

93.2%

JSON

nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted (1) SiteUrl or (2) RedirectUrl parameter that points to a Trojan Horse client.zip update file.

Affected configurations

NVD

Node

nomachinenx_web_companionRange≤3.5.0-2

nomachinenx_web_companionMatch1.5.0beta2

nomachinenx_web_companionMatch1.5.0beta3

nomachinenx_web_companionMatch2.0.0-1

nomachinenx_web_companionMatch2.1.0-1

nomachinenx_web_companionMatch3.0.0-1

nomachinenx_web_companionMatch3.0.0-2

nomachinenx_web_companionMatch3.0.0-3

nomachinenx_web_companionMatch3.0.0-4

nomachinenx_web_companionMatch3.0.0-5

nomachinenx_web_companionMatch3.1.0-1

nomachinenx_web_companionMatch3.2.0-1

nomachinenx_web_companionMatch3.3.0-1

nomachinenx_web_companionMatch3.3.0-2

nomachinenx_web_companionMatch3.4.0-1

nomachinenx_web_companionMatch3.4.0-2

nomachinenx_web_companionMatch3.4.0-3

nomachinenx_web_companionMatch3.5.0-1

CPENameOperatorVersion
nomachine:nx_web_companionnomachine nx web companionle3.5.0-2
nomachine:nx_web_companionnomachine nx web companioneq1.5.0
nomachine:nx_web_companionnomachine nx web companioneq2.0.0-1
nomachine:nx_web_companionnomachine nx web companioneq2.1.0-1
nomachine:nx_web_companionnomachine nx web companioneq3.0.0-1
nomachine:nx_web_companionnomachine nx web companioneq3.0.0-2
nomachine:nx_web_companionnomachine nx web companioneq3.0.0-3
nomachine:nx_web_companionnomachine nx web companioneq3.0.0-4
nomachine:nx_web_companionnomachine nx web companioneq3.0.0-5
nomachine:nx_web_companionnomachine nx web companioneq3.1.0-1

CPE	Name	Operator	Version
nomachine:nx_web_companion	nomachine nx web companion	le	3.5.0-2
nomachine:nx_web_companion	nomachine nx web companion	eq	1.5.0
nomachine:nx_web_companion	nomachine nx web companion	eq	2.0.0-1
nomachine:nx_web_companion	nomachine nx web companion	eq	2.1.0-1
nomachine:nx_web_companion	nomachine nx web companion	eq	3.0.0-1
nomachine:nx_web_companion	nomachine nx web companion	eq	3.0.0-2
nomachine:nx_web_companion	nomachine nx web companion	eq	3.0.0-3
nomachine:nx_web_companion	nomachine nx web companion	eq	3.0.0-4
nomachine:nx_web_companion	nomachine nx web companion	eq	3.0.0-5
nomachine:nx_web_companion	nomachine nx web companion	eq	3.1.0-1

Rows per page:

1-10 of 171

References

archives.neohapsis.com/archives/bugtraq/2012-01/0161.html

archives.neohapsis.com/archives/fulldisclosure/2012-01/0466.html

secunia.com/advisories/47685

exchange.xforce.ibmcloud.com/vulnerabilities/72712

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

AI Score

Confidence

High

0.054 Low

EPSS

Percentile

93.2%

JSON

Related for CVE-2012-5003

cvelist1 prion1 nvd1