CVE-2020-16101

Severity: High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Components affected: Gallagher Command Centre Server
Version of Command Centre affected: Versions of v8.20 prior to v8.20.1166(MR3), versions of 8.10 prior to v8.10.1211(MR5),  versions of 8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier.
Reported by: Gallagher
Active exploitation of vulnerability*: No
Description of vulnerability:  It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5),  v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier.
Mitigation: Configure the firewall on the Command Centre server machine to restrict access to the DCOM websocket port (8905), as recommended in the Hardening Guide.

Maintenance releases are now available for:

• v8.20 - v8.20.1166(MR3)
• v8.10 - v8.10.1211(MR5)
• v8.00 - v8.00.1228(MR6)

Important notes:

• These maintenance upgrades require the Command Centre server to be upgraded.

*This indicates whether Gallagher are aware of this being actively exploited against customer sites.