CVE-2019-3956 - Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPubKeyLen during key negotiation, which could crash the application or leak sensitive information

Back Back to CVE browser

HIGH

Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPubKeyLen during key negotiation, which could crash the application or leak sensitive information

Published Jun 7, 2019

7.4

HIGH

CVSS 3.0

EPSS 1.63%

Description

Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPubKeyLen during key negotiation, which could crash the application or leak sensitive information.

Affected products

Vendor n/a Product Solarwinds Dameware Remote Mini Controller Default
n/a
- Version
  All versions prior to version 12.1.0.34
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Solarwinds Dameware Remote Mini Controller

n/a

Version	Status	Constraints
All versions prior to version 12.1.0.34	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-20

Improper Input Validation

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13563
Advisory
https://www.tenable.com/security/research/tra-2019-26
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13563		Advisory
https://www.tenable.com/security/research/tra-2019-26		x_refsource_MISCExploitThird Party Advisory