漏洞标题
N/A
漏洞描述信息
管理引擎资产 Explorer 代理 1.0.34 监听于端口 9000 从管理引擎服务器的 HTTPS 接收命令。HTTPS 证书未验证，允许网络上任意的使用者发送命令于端口 9000。尽管这些命令可能不会执行(由于验证身份令牌)，但资产 Explorer 代理将向管理引擎服务器发送 HTTP 请求。在这个过程中，AEAgent.cpp 使用 "malloc" 分配 0x66 字节。此内存在程序中从未释放，导致内存泄漏。此外，将发送给 aeagent(例如 NewsSentry、 DeltaSCAN 等)的指令转换为 Unicode 字符串，但从未释放。这些内存泄漏允许远程攻击者通过重复向代理发送这些命令来利用 DDoS 场景，并最终因内存不足而崩溃代理。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
ZOHO ManageEngine AssetExplorer 安全漏洞
漏洞描述信息
ZOHO ManageEngine AssetExplorer是美国卓豪（ZOHO）公司的一套资产管理软件。该软件提供资产跟踪、IT资产的扫描和资产所有权的跟踪等功能。 ZOHO ManageEngine AssetExplorer Agent 1.0.34版本存在安全漏洞，该漏洞源于程序在9000端口上监听来自Manage Engine Server的HTTPS传入命令时HTTPS证书不被验证，这允许网络上的任意用户通过9000端口发送命令。
CVSS信息
N/A
漏洞类别
其他