BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allows remote attackers to bypass authentication via (1) an unknown attack vector or (2) a NULL (0x00) as a username.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bfcc | Bfcommand_and_control_software | * | 1.22_a (including) |
| Bfvcc | Bfcommand_and_control_software | 2.00_a (including) | 2.00_a (including) |
| Bfvcc | Bfcommand_and_control_software | 2.14_b (including) | 2.14_b (including) |
References
- http://aluigi.altervista.org/adv/bfccown-adv.txt
- http://marc.info/?l=bugtraq\u0026m=112534155318828\u0026w=2
- http://secunia.com/advisories/16629/
- http://www.securityfocus.com/bid/14690
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22055
- http://aluigi.altervista.org/adv/bfccown-adv.txt
- http://marc.info/?l=bugtraq\u0026m=112534155318828\u0026w=2
- http://secunia.com/advisories/16629/
- http://www.securityfocus.com/bid/14690
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22055