Remote Buffer Over-read Vulnerability in Dameware Remote Mini Control by SolarWinds
CVE-2019-3957

7.4HIGH

Key Information:

Vendor
Solarwinds
Status
Solarwinds Dameware Remote Mini Controller
Vendor
CVE Published:
7 June 2019

Summary

The vulnerability in Dameware Remote Mini Control arises from an unauthenticated remote buffer over-read. The flaw occurs when the server fails to properly validate the RsaSignatureLen during the key negotiation process. This oversight can lead to application crashes or potential leakage of sensitive information, exposing users to various security risks.

Affected Version(s)

Solarwinds Dameware Remote Mini Controller All versions prior to version 12.1.0.34

References

https://www.tenable.com/security/research/tra-2019-26
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.