CVE-2017-17099

High

Published: 03/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

There exists an unauthenticated SEH based Buffer Overflow vulnerability in the HTTP server of Flexense SyncBreeze Enterprise v10.1.16. When sending a GET request with an excessive length, it is possible for a malicious user to overwrite the SEH record and execute a payload that would run under the Windows SYSTEM account.

Risk Assessment

This vulnerability allows for remote code execution by an unauthenticated user, potentially leading to full system compromise. Consequently, the organization may lose control over its resources and data.

Recommendation

It is recommended to update to the latest version of Flexense SyncBreeze to eliminate this vulnerability. Additionally, implementing restrictions on HTTP request lengths can help minimize the risk.

Other vulnerabilities in Flexense SyncBreeze Enterprise v10.1.16

CVE-2017-15950High
Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the 'Destination directory' field, either within an XML document or through use of passive mode.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS