CVE-2006-6476 - Vulnerability Details - OpenCVE

Description

FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation).

Published: 2006-12-20

Score: 2.4 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:mandiant:first_response:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2006-6459	FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity High

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00099.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://secunia.com/advisories/23393
http://securityreason.com/securityalert/2052
http://securitytracker.com/id?1017394
http://www.mandiant.com/firstresponse.htm
http://www.securityfocus.com/archive/1/454712/100/0/threaded
http://www.securityfocus.com/bid/21548
http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt
http://www.vupen.com/english/advisories/2006/5061

History

No history.

Subscriptions

Mandiant First Response

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-12-20T02:00:00.000Z

Updated: 2024-08-07T20:26:46.545Z

Reserved: 2006-12-11T00:00:00.000Z

Link: CVE-2006-6476

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-12-20T02:28:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2006-6476

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-Other

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-12-18T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.mandiant.com/firstresponse.htm"}, {"name": "20061218 SYMSA-2006-013: Multiple Vulnerabilities in Mandiant First Response", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"name": "23393", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23393"}, {"name": "ADV-2006-5061", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"name": "21548", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/21548"}, {"name": "2052", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2052"}, {"name": "1017394", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1017394"}, {"tags": ["x_refsource_MISC"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-6476", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.mandiant.com/firstresponse.htm", "refsource": "CONFIRM", "url": "http://www.mandiant.com/firstresponse.htm"}, {"name": "20061218 SYMSA-2006-013: Multiple Vulnerabilities in Mandiant First Response", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"name": "23393", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23393"}, {"name": "ADV-2006-5061", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"name": "21548", "refsource": "BID", "url": "http://www.securityfocus.com/bid/21548"}, {"name": "2052", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2052"}, {"name": "1017394", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1017394"}, {"name": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt", "refsource": "MISC", "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T20:26:46.545Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mandiant.com/firstresponse.htm"}, {"name": "20061218 SYMSA-2006-013: Multiple Vulnerabilities in Mandiant First Response", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"name": "23393", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23393"}, {"name": "ADV-2006-5061", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"name": "21548", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/21548"}, {"name": "2052", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2052"}, {"name": "1017394", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1017394"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-6476", "datePublished": "2006-12-20T02:00:00.000Z", "dateReserved": "2006-12-11T00:00:00.000Z", "dateUpdated": "2024-08-07T20:26:46.545Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mandiant:first_response:*:*:*:*:*:*:*:*", "matchCriteriaId": "6178A165-0EF2-45CC-B06E-275694754DAC", "versionEndIncluding": "1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation)."}, {"lang": "es", "value": "FRAgent.exe en Mandiant First Response (MFR) anterior a 1.1.1, cuando est\u00e1 funcionando en modo demonio y cuando el agente est\u00e1 vinculado a 0.0.0.0 (todas las interfaces), abre los sockets en modo no-exclusivo, lo cual permite a un usuario local secuestrar el socket, y capturar datos o provocar denegaci\u00f3n de servicio (perdida de operaci\u00f3n de demonio)"}], "evaluatorSolution": "Successful exploitation requires that the affected products are run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces).\r\nThis vulnerability is addressed in the following product release:\r\nMandiant, First Response, 1.1.1", "id": "CVE-2006-6476", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-12-20T02:28:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/23393"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2052"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://securitytracker.com/id?1017394"}, {"source": "cve@mitre.org", "url": "http://www.mandiant.com/firstresponse.htm"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/21548"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/23393"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2052"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://securitytracker.com/id?1017394"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandiant.com/firstresponse.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/21548"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/5061"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}