NVD

Id
62506  
Name
CVE-2006-3838  
Description
Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b) iPolicy Security Manager, (c) Astaro Report Manager, (d) Fortinet FortiReporter, (e) Top Layer Network Security Analyzer, and possibly other products, allow remote attackers to execute arbitrary code via long (1) DELTAINTERVAL, (2) LOGFOLDER, (3) DELETELOGS, (4) FWASERVER, (5) SYSLOGPUBLICIP, (6) GETFWAIMPORTLOG, (7) GETFWADELTA, (8) DELETERDEPDEVICE, (9) COMPRESSRAWLOGFILE, (10) GETSYSLOGFIREWALLS, (11) ADDPOLICY, and (12) EDITPOLICY commands to the Syslog daemon (syslogserver.exe); (13) GUIADDDEVICE, (14) ADDDEVICE, and (15) DELETEDEVICE commands to the Topology server (Topology.exe); the (15) LICMGR_ADDLICENSE command to the License Manager (EnterpriseSecurityAnalyzer.exe); the (16) TRACE and (17) QUERYMONITOR commands to the Monitoring agent (Monitoring.exe); and possibly other vectors related to the Syslog daemon (syslogserver.exe).  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2016-12-20  
Published
2006-07-26  
Modified Date
2011-09-06  
Seq
2006-3838  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
324724 62506 CVE-2006-3838 20060808 TSRT-06-07: eIQnetworks Enterprise Security Analyzer Monitoring Agent Buffer Overflow Vulnerabilities  View
324725 62506 CVE-2006-3838 1016580  View
324726 62506 CVE-2006-3838 http://www.eiqnetworks.com/products/enterprisesecurity/EnterpriseSecurityAnalyzer/ESA_2.5.0_Release_Notes.pdf  View
324727 62506 CVE-2006-3838 VU#513068  View
324728 62506 CVE-2006-3838 20060725 ZDI-06-024: eIQNetworks Enterprise Security Analyzer License Manager Buffer Overflow Vulnerability  View
324729 62506 CVE-2006-3838 20060725 ZDI-06-023: eIQNetworks Enterprise Security Analyzer Syslog Server Buffer Overflow Vulnerability  View
324730 62506 CVE-2006-3838 20060725 TSRT-06-04: eIQnetworks Enterprise Security Analyzer Topology Server Buffer Overflow Vulnerability  View
324731 62506 CVE-2006-3838 20060725 TSRT-06-03: eIQnetworks Enterprise Security Analyzer Syslog Server Buffer Overflow Vulnerabilities  View
324732 62506 CVE-2006-3838 19163  View
324733 62506 CVE-2006-3838 19164  View
324734 62506 CVE-2006-3838 19165  View
324735 62506 CVE-2006-3838 19167  View
324736 62506 CVE-2006-3838 http://www.tippingpoint.com/security/advisories/TSRT-06-03.html  View
324737 62506 CVE-2006-3838 http://www.tippingpoint.com/security/advisories/TSRT-06-04.html  View
324738 62506 CVE-2006-3838 http://www.tippingpoint.com/security/advisories/TSRT-06-07.html  View
324739 62506 CVE-2006-3838 ADV-2006-2985  View
324740 62506 CVE-2006-3838 ADV-2006-3006  View
324741 62506 CVE-2006-3838 ADV-2006-3007  View
324742 62506 CVE-2006-3838 ADV-2006-3008  View
324743 62506 CVE-2006-3838 ADV-2006-3009  View
324744 62506 CVE-2006-3838 ADV-2006-3010  View
324745 62506 CVE-2006-3838 http://www.zerodayinitiative.com/advisories/ZDI-06-023.html  View
324746 62506 CVE-2006-3838 http://www.zerodayinitiative.com/advisories/ZDI-06-024.html  View
324747 62506 CVE-2006-3838 eiqnetworks-esa-syslog-string-bo(27950)  View
324748 62506 CVE-2006-3838 eiqnetworks-esa-syslog-command-bo(27951)  View
324749 62506 CVE-2006-3838 eiqnetworks-esa-licensemanager-bo(27952)  View
324750 62506 CVE-2006-3838 eiqnetworks-esa-topology-bo(27953)  View
324751 62506 CVE-2006-3838 eiqnetworks-esa-monitoring-bo(27954)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
60639 JVNDB-2006-002905 eIQnetworks ESA におけるスタックベースのバッファオーバーフローの脆弱性 以下の製品で使用される eIQnetworks Enterprise Security Analyzer (ESA) は、Syslog デーモン (syslogserver.exe) に関する処理に不備があるため、スタックベースのバッファオーバーフローの脆弱性が存在します。 CVE-2006-3838 19940 CVE-2006-3838 62506 10 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002905.html 2006-07-26 2012-12-20 View