CVE-2023-28502 : Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions

Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user.

Published 2023-03-29 21:15:08

Updated 2023-04-12 19:15:08

Source Rapid7, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionExecute code

Products affected by CVE-2023-28502

Rocketsoftware » Unidata
Versions up to, including, (<=) 8.2.4
cpe:2.3:a:rocketsoftware:unidata:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
Rocketsoftware » Universe
Versions from including (>=) 12.0.0 and up to, including, (<=) 12.2.1
cpe:2.3:a:rocketsoftware:universe:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
Rocketsoftware » Universe
Versions up to, including, (<=) 11.3.5
cpe:2.3:a:rocketsoftware:universe:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-28502

EPSS FAQ

15.30%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2023-28502

Rocket Software Unidata udadmin_server Stack Buffer Overflow in Password

Disclosure Date: 2023-03-30

First seen: 2023-09-11

exploit/linux/misc/unidata_udadmin_password_stack_overflow

This modlue exploits an authentication bypass vulnerability in the Linux version of udadmin_server, which is an RPC service that comes with the Rocket Software UniData server, which runs as root. This vulnerability affects UniData versions 8.2.4 build 3003 a

More information

CVSS scores for CVE-2023-28502

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-28502

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: cve@rapid7.con (Secondary)
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-28502

http://packetstormsecurity.com/files/171853/Rocket-Software-Unidata-8.2.4-Build-3003-Buffer-Overflow.html

Rocket Software Unidata 8.2.4 Build 3003 Buffer Overflow ≈ Packet Storm
https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed/

Multiple Vulnerabilities in Rocket Software UniData's UniRPC server (Fixed) | Rapid7 Blog
Third Party Advisory

CVEs referencing this url

Jump to