Vulnerability Details : CVE-2012-4956
Public exploit exists!
Heap-based buffer overflow in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to execute arbitrary code via a large number of VOL elements in an SRS record.
Vulnerability category: OverflowExecute code
Products affected by CVE-2012-4956
- cpe:2.3:a:novell:file_reporter:1.0.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-4956
10.80%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2012-4956
-
NFR Agent Heap Overflow Vulnerability
Disclosure Date: 2012-11-16First seen: 2020-04-26auxiliary/dos/http/novell_file_reporter_heap_bofThis module exploits a heap overflow in NFRAgent.exe, a component of Novell File Reporter (NFR). The vulnerability occurs when handling requests of name "SRS", where NFRAgent.exe fails to generate a response in a secure way, copying user controlled data into a fixe
CVSS scores for CVE-2012-4956
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2012-4956
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-4956
-
http://www.kb.cert.org/vuls/id/273371
VU#273371 - Novell File Reporter contains multiple vulnerabilitiesUS Government Resource
-
https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
New 0day Exploits: Novell File Reporter VulnerabilitiesExploit
Jump to