CVE-2011-5227
Enterasys NetSight < 4.1.0.79 - Remote Code Execution via Long PRIO Field in Syslog Message
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-5227.
PoCs published by Metasploit, Jeremy Brown, including Metasploit module exploits/windows/misc/enterasys_netsight_syslog_bof.
AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in Enterasys NetSight's Syslog service (nssyslogd.exe) via a crafted PRIO field in a syslog message. It achieves remote code execution by leveraging ROP gadgets and stack pivoting techniques.
Description
Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514.
Exploits (2)
This Metasploit module exploits a stack buffer overflow in Enterasys NetSight's Syslog service (nssyslogd.exe) via a crafted PRIO field in a syslog message. It achieves remote code execution by leveraging ROP gadgets and stack pivoting techniques.
This Metasploit module exploits a stack buffer overflow in Enterasys NetSight's Syslog service (nssyslogd.exe) via a crafted PRIO field in a syslog message. It achieves remote code execution by leveraging stack pivoting and ROP chains tailored for Windows XP SP3 and Windows 2003 SP2.