CVE-2011-0649 - Multiple unspecified vulnerabilities in TIBCO Rendezvous 8.2.1 through 8.3.0, Enterprise Message Ser

CVE-2011-0649

Summary

Multiple unspecified vulnerabilities in TIBCO Rendezvous 8.2.1 through 8.3.0, Enterprise Message Service (EMS) 5.1.0 through 6.0.0, Runtime Agent (TRA) 5.6.2 through 5.7.0, Silver BPM Service before 1.0.4, Silver CAP Service vebefore 1.0.2, and Silver BusinessWorks Service 1.0.0, when running on Unix systems, allow local users to gain root privileges via unknown vectors related to SUID and (1) Rendezvous Routing Daemon (rvrd), (2) Rendezvous Secure Daemon (rvsd), (3) Rendezvous Secure Routing Daemon (rvsrd), and (4) EMS Server (tibemsd). Per: http://www.tibco.com/multimedia/rv_ems_security_advisory_20110201_tcm8-13185.txt 'On Unix-based systems a successful attack will result in a privilege escalation to root, granting the attacker full administrative control of the host.' Per: http://www.tibco.com/multimedia/rv_ems_security_advisory_20110201_tcm8-13185.txt 'TIBCO Rendezvous and EMS components listed above contain a SUID vulnerability which could potentially grant unauthorized root access to an attacker on Unix-based systems.'

References

Vulnerable Configurations

cpe:2.3:a:tibco:rendezvous:8.2.1:*:*:*:*:*:*:*
cpe:2.3:a:tibco:rendezvous:8.2.1:*:*:*:*:*:*:*
cpe:2.3:a:tibco:rendezvous:8.3.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:rendezvous:8.3.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:enterprise_message_service:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:enterprise_message_service:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:enterprise_message_service:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:tibco:enterprise_message_service:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:tibco:enterprise_message_service:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:enterprise_message_service:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:runtime_agent:5.6.2:*:*:*:*:*:*:*
cpe:2.3:a:tibco:runtime_agent:5.6.2:*:*:*:*:*:*:*
cpe:2.3:a:tibco:runtime_agent:5.7.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:runtime_agent:5.7.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_bpm_service:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_bpm_service:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_bpm_service:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_bpm_service:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_cap_service:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_cap_service:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_cap_service:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_cap_service:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_businessworks_service:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:silver_businessworks_service:1.0.0:*:*:*:*:*:*:*

CVSS

Base:	7.2 (as of 17-08-2017 - 01:33)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	46104
confirm	http://www.tibco.com/multimedia/rv_ems_security_advisory_20110201_tcm8-13185.txt
secunia	43160 43174
vupen	ADV-2011-0269
xf	tibco-suid-privilege-escalation(65105)

Last major update

17-08-2017 - 01:33

Published

04-02-2011 - 01:00

Last modified

17-08-2017 - 01:33