CVE-2021-28180
Assigner: twcert
Published: 2021-04-06T00:00:00
State: PUBLISHED
affected: product: BMC firmware for Z10PR-D16
vendor: ASUS
versions: status: affected
version: 1.14.51
product: BMC firmware for ASMB8-iKVM
vendor: ASUS
versions: status: affected
version: 1.14.51
product: BMC firmware for Z10PE-D16 WS
vendor: ASUS
versions: status: affected
version: 1.14.2
datePublic: 2021-04-06T00:00:00
descriptions: value: The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-120
description: CWE-120 Buffer Overflow
type: CWE
solutions: value: update BMC's firmwares to the following versions:
Z10PR-D16 1.16.1
ASMB8-iKVM 1.16.1
Z10PE-D16 WS 1.16.1
source: advisory: TVN-202103007
discovery: EXTERNAL
title: ASUS BMC's firmware: buffer overflow - Audit log configuration setting
x_generator: engine: Vulnogram 0.0.9