CVE-2014-7266: High severity cybozu remote service manager vulnerability

Published Feb 1, 2015

Updated

Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service (CPU consumption) via vectors that trigger colliding hash-table keys. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1983.

Affected Software

4 affected components

Cybozu Remote Service Manager=2.3.0

Cybozu Remote Service Manager=3.1.0

Cybozu Remote Service Manager=3.1.1

Cybozu Remote Service Manager=3.1.2

Remediation

Patch Available

https://cs.cybozu.co.jp/2015/001245.html

Event History

Feb 1, 2015

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-7266?

CVE-2014-7266 has a medium severity level due to its potential to cause denial of service through CPU consumption.

How do I fix CVE-2014-7266?

To fix CVE-2014-7266, upgrade to versions of Cybozu Remote Service Manager that are higher than 3.1.2.

What systems are affected by CVE-2014-7266?

CVE-2014-7266 affects Cybozu Remote Service Manager versions 2.3.0, 3.1.0, 3.1.1, and 3.1.2.

Can CVE-2014-7266 be exploited remotely?

Yes, CVE-2014-7266 can be exploited remotely by attackers to trigger CPU consumption.

What type of vulnerability is CVE-2014-7266?

CVE-2014-7266 is classified as an algorithmic complexity vulnerability.