CVE-2011-0489 - Vulnerability Details - OpenCVE

The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the Advanced Multithreaded Server, as demonstrated by commands that are ordinarily sent by the (a) ookillls and (b) oostopams applications. NOTE: some of these details are obtained from third party information.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.24624.

Key SSVC decision points have not yet been added.

Vendors	Products
Objectivity	Objectivity\/db

Configuration 1 [-]

cpe:2.3:a:objectivity:objectivity\/db:10.0:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://osvdb.org/70424
http://secunia.com/advisories/42901
http://www.exploit-db.com/exploits/15988
http://www.kb.cert.org/vuls/id/782567
http://www.securityfocus.com/bid/45803
http://www.vupen.com/english/advisories/2011/0127
https://exchange.xforce.ibmcloud.com/vulnerabilities/64699

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2011-01-18T17:00:00

Updated: 2024-08-06T21:51:09.167Z

Reserved: 2011-01-18T00:00:00

Link: CVE-2011-0489

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2011-01-18T18:03:09.080

Modified: 2025-04-11T00:51:21.963

Link: CVE-2011-0489

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-01-13T00:00:00", "descriptions": [{"lang": "en", "value": "The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the Advanced Multithreaded Server, as demonstrated by commands that are ordinarily sent by the (a) ookillls and (b) oostopams applications. NOTE: some of these details are obtained from third party information."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "42901", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/42901"}, {"name": "15988", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/15988"}, {"name": "objectivity-operations-sec-bypass(64699)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64699"}, {"name": "70424", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/70424"}, {"name": "VU#782567", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/782567"}, {"name": "45803", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/45803"}, {"name": "ADV-2011-0127", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2011/0127"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2011-0489", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the Advanced Multithreaded Server, as demonstrated by commands that are ordinarily sent by the (a) ookillls and (b) oostopams applications. NOTE: some of these details are obtained from third party information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "42901", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/42901"}, {"name": "15988", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/15988"}, {"name": "objectivity-operations-sec-bypass(64699)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64699"}, {"name": "70424", "refsource": "OSVDB", "url": "http://osvdb.org/70424"}, {"name": "VU#782567", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/782567"}, {"name": "45803", "refsource": "BID", "url": "http://www.securityfocus.com/bid/45803"}, {"name": "ADV-2011-0127", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2011/0127"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T21:51:09.167Z"}, "title": "CVE Program Container", "references": [{"name": "42901", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/42901"}, {"name": "15988", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/15988"}, {"name": "objectivity-operations-sec-bypass(64699)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64699"}, {"name": "70424", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/70424"}, {"name": "VU#782567", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/782567"}, {"name": "45803", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/45803"}, {"name": "ADV-2011-0127", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2011/0127"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2011-0489", "datePublished": "2011-01-18T17:00:00", "dateReserved": "2011-01-18T00:00:00", "dateUpdated": "2024-08-06T21:51:09.167Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:objectivity:objectivity\\/db:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "DD07FFFD-237B-4334-B419-1FA34C200279", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the Advanced Multithreaded Server, as demonstrated by commands that are ordinarily sent by the (a) ookillls and (b) oostopams applications. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "Los componentes de servidor en Objetivity/DB v10.0, no requieren de autenticaci\u00f3n para los comandos de administraci\u00f3n, lo que permite a atacantes remotos modificar los datos, obtener informaci\u00f3n sensible o causar una denegaci\u00f3n de servicio mediante el env\u00edo de solicitudes a trav\u00e9s de TCP a (1) Lock Server (2) Advanced Multithreaded Server, como lo demuestran los comandos que son normalmente enviados por el (a) ookillls y (b) las aplicaciones oostopams. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros."}], "id": "CVE-2011-0489", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-01-18T18:03:09.080", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/70424"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42901"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/15988"}, {"source": "cve@mitre.org", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/782567"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/45803"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2011/0127"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64699"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/70424"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42901"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/15988"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/782567"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/45803"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2011/0127"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64699"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}