A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze…

Exploit prediction (EPSS)

78.66% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

• Metasploit exploit/windows/http/dupscts_bof Dup Scout Enterprise GET Buffer Overflow · metasploit exploit, great rank · 2017-03-15
• Metasploit exploit/windows/http/dup_scout_enterprise_login_bof Dup Scout Enterprise Login Buffer Overflow · metasploit exploit, great rank · 2017-11-14
• Metasploit exploit/windows/http/disk_pulse_enterprise_get Disk Pulse Enterprise GET Buffer Overflow · metasploit exploit, excellent rank · 2017-08-25

CVSS scores

Classification

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

• exploit-db.com /exploits/42557 · exploit, x_refsource_EXPLOIT-DB, x_transferred
• exploit-db.com /exploits/42560/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
• rapid7.com /db/modules/exploit/windows/http/disk_pulse_enterprise_get · x_refsource_MISC, x_transferred
• exploit-db.com /exploits/42559/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
• exploit-db.com /exploits/42558/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

• CVE List: CVE-2017-13696
• NVD: CVE-2017-13696

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.