Detections
Analytics
Computer Associates XOsoft Multiple Flaws (CA20100406) (credentialed check)
critical Nessus Plugin ID 45503
Language:
Synopsis
The remote Windows host contains an application that is affected by multiple vulnerabilities.Description
XOsoft, a product from Computer Associates for combined business continuity and disaster recovery, is installed on the remote Windows host.According to its version, it is affected by several vulnerabilities.
- By sending a specially crafted SOAP request, it may be possible for an unauthenticated attacker to enumerate users on the remote system. (CVE-2010-1221)
- By sending a specially crafted SOAP request, it may be possible for an unauthenticated attacker to gain sensitive information from the remote system. (CVE-2010-1222)
- By sending a specially crafted request, it may be possible for an attacker to execute arbitrary code on the remote system within the context of the service or trigger a denial of service condition. (CVE-2010-1223)
Solution
Apply vendor-supplied patches.See Also
https://www.zerodayinitiative.com/advisories/ZDI-10-065/
https://www.zerodayinitiative.com/advisories/ZDI-10-066/
Plugin Details
Severity: Critical
ID: 45503
File Name: ca_xosoft_multiple_flaws.nasl
Version: 1.8
Type: local
Agent: windows
Family: Windows
Published: 4/13/2010
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
Required KB Items: SMB/Registry/Enumerated
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/6/2010
Vulnerability Publication Date: 4/6/2010
Exploitable With
CANVAS (D2ExploitPack)
Core Impact
Reference Information
CVE: CVE-2010-1221, CVE-2010-1222, CVE-2010-1223
Secunia: 39337