CVE-2006-6476 - Vulnerability Details - OpenCVE

FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation).

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity High

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00099.

Key SSVC decision points have not yet been added.

Vendors	Products
Mandiant Subscribe	First Response Subscribe

Configuration 1 [-]

cpe:2.3:a:mandiant:first_response:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2006-6459	FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation).

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/23393
http://securityreason.com/securityalert/2052
http://securitytracker.com/id?1017394
http://www.mandiant.com/firstresponse.htm
http://www.securityfocus.com/archive/1/454712/100/0/threaded
http://www.securityfocus.com/bid/21548
http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt
http://www.vupen.com/english/advisories/2006/5061

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-12-20T02:00:00

Updated: 2024-08-07T20:26:46.545Z

Reserved: 2006-12-11T00:00:00

Link: CVE-2006-6476

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-12-20T02:28:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2006-6476

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-Other

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-12-18T00:00:00", "descriptions": [{"lang": "en", "value": "FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.mandiant.com/firstresponse.htm"}, {"name": "20061218 SYMSA-2006-013: Multiple Vulnerabilities in Mandiant First Response", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"name": "23393", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23393"}, {"name": "ADV-2006-5061", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"name": "21548", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/21548"}, {"name": "2052", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2052"}, {"name": "1017394", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1017394"}, {"tags": ["x_refsource_MISC"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-6476", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.mandiant.com/firstresponse.htm", "refsource": "CONFIRM", "url": "http://www.mandiant.com/firstresponse.htm"}, {"name": "20061218 SYMSA-2006-013: Multiple Vulnerabilities in Mandiant First Response", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"name": "23393", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23393"}, {"name": "ADV-2006-5061", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"name": "21548", "refsource": "BID", "url": "http://www.securityfocus.com/bid/21548"}, {"name": "2052", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2052"}, {"name": "1017394", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1017394"}, {"name": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt", "refsource": "MISC", "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T20:26:46.545Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mandiant.com/firstresponse.htm"}, {"name": "20061218 SYMSA-2006-013: Multiple Vulnerabilities in Mandiant First Response", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"name": "23393", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23393"}, {"name": "ADV-2006-5061", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"name": "21548", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/21548"}, {"name": "2052", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2052"}, {"name": "1017394", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1017394"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-6476", "datePublished": "2006-12-20T02:00:00", "dateReserved": "2006-12-11T00:00:00", "dateUpdated": "2024-08-07T20:26:46.545Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mandiant:first_response:*:*:*:*:*:*:*:*", "matchCriteriaId": "6178A165-0EF2-45CC-B06E-275694754DAC", "versionEndIncluding": "1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation)."}, {"lang": "es", "value": "FRAgent.exe en Mandiant First Response (MFR) anterior a 1.1.1, cuando est\u00e1 funcionando en modo demonio y cuando el agente est\u00e1 vinculado a 0.0.0.0 (todas las interfaces), abre los sockets en modo no-exclusivo, lo cual permite a un usuario local secuestrar el socket, y capturar datos o provocar denegaci\u00f3n de servicio (perdida de operaci\u00f3n de demonio)"}], "evaluatorSolution": "Successful exploitation requires that the affected products are run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces).\r\nThis vulnerability is addressed in the following product release:\r\nMandiant, First Response, 1.1.1", "id": "CVE-2006-6476", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-12-20T02:28:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/23393"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2052"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://securitytracker.com/id?1017394"}, {"source": "cve@mitre.org", "url": "http://www.mandiant.com/firstresponse.htm"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/21548"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/5061"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/23393"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2052"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://securitytracker.com/id?1017394"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandiant.com/firstresponse.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/454712/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/21548"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.symantec.com/enterprise/research/SYMSA-2006-013.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/5061"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}