Vulnerabilities in Enterasys' network management
Enterasys' network management platform NetSight contains multiple vulnerabilities via which an attacker can take over or crash a system. For example, according to information from iDefense, there is a bug in the file name reading function in the TFTPD server. Names that are too long cause a buffer overflow allowing an attacker to inject code, execute it and take control of the system.
In addition, the BOOTPD server has a vulnerability which crashes the service. A single UDP packet suffices to achieve this. The vulnerabilities were found in versions NetSight Console 2.1 and NetSight Inventory Manager 2.1 under Windows XP and 2000, neither of which are current. Other versions are also probably affected. In the current releases NetSight Console 2.3.1 build 6 and NetSight Inventory Manager 2.2.2 build 4 the vulnerability is ostensibly fixed.
- Enterasys Networks Multiple NetSight Products Multiple Vulnerabilities, error report from iDefense
(mba)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
