NVD

Id
82862  
Name
CVE-2016-9683  
Description
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the "extensionsettings" CGI (/cgi-bin/extensionsettings) component responsible for handling some of the server"s internal configurations. The CGI application doesn"t properly escape the information it"s passed when processing a particular multi-part form request involving scripts. The filename of the "scriptname" variable is read in unsanitized before a call to system() is performed - allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account. This is SonicWall Issue ID 181195.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-02-28  
Published
2017-02-22  
Modified Date
2017-02-23  
Seq
2016-9683  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
407823 82862 CVE-2016-8689 openSUSE-SU-2016:3002  View
407824 82862 CVE-2016-8689 [oss-security] 20161015 Re: Libarchive/bsdtar: multiple crashes  View
407825 82862 CVE-2016-8689 93781  View
407826 82862 CVE-2016-8689 https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-heap-based-buffer-overflow-in-read_header-archive_read_support_format_7zip-c/  View
407827 82862 CVE-2016-8689 https://bugzilla.redhat.com/show_bug.cgi?id=1377925  View
407828 82862 CVE-2016-8689 https://github.com/libarchive/libarchive/commit/7f17c791dcfd8c0416e2cd2485b19410e47ef126  View
407829 82862 CVE-2016-8689 GLSA-201701-03  View

Related JVN