Boks Manager Boks Server
Monthly
Predictable Active Directory service-account password generation in Fortra BoKS Manager's boks_keytabmd daemon allows an attacker who knows the target service principal and can approximate the password-change timestamp to regenerate the seed, reconstruct the limited candidate set, and verify guesses offline against a captured Kerberos ticket or authentication endpoint. Only deployments that use BoKS keytab management to automate AD service-account credentials on boks-server versions before 9.0.0.6 are exposed, which makes exploitation targeted rather than opportunistic. No public exploit code or confirmed in-the-wild exploitation is identified at time of analysis (no CISA KEV listing, SSVC exploitation value 'none'), but the assessed impact is total for affected credential material, making mandatory post-patch rotation of every generated service-account password essential.
Heap-based out-of-bounds write in the boks_ksllogsd logging daemon of Fortra BoKS Manager / BoKS Server allows an authenticated KSL client to corrupt memory by placing an oversized but OpenSSL-recognized digest name in the MD field of a KSL start message. The daemon validates that OpenSSL recognizes the supplied digest name but does not confirm that the name fits the fixed 16-byte checksum context field before copying, so an over-long value is written past the end of the heap allocation (CWE-787; CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Because the attacker must already hold KSL client credentials and the written content is constrained to valid digest-name strings, the practical result is a crash or memory corruption of the logging service rather than reliable remote code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority availability risk pending a vendor fix.
Predictable Active Directory service-account password generation in Fortra BoKS Manager's boks_keytabmd daemon allows an attacker who knows the target service principal and can approximate the password-change timestamp to regenerate the seed, reconstruct the limited candidate set, and verify guesses offline against a captured Kerberos ticket or authentication endpoint. Only deployments that use BoKS keytab management to automate AD service-account credentials on boks-server versions before 9.0.0.6 are exposed, which makes exploitation targeted rather than opportunistic. No public exploit code or confirmed in-the-wild exploitation is identified at time of analysis (no CISA KEV listing, SSVC exploitation value 'none'), but the assessed impact is total for affected credential material, making mandatory post-patch rotation of every generated service-account password essential.
Heap-based out-of-bounds write in the boks_ksllogsd logging daemon of Fortra BoKS Manager / BoKS Server allows an authenticated KSL client to corrupt memory by placing an oversized but OpenSSL-recognized digest name in the MD field of a KSL start message. The daemon validates that OpenSSL recognizes the supplied digest name but does not confirm that the name fits the fixed 16-byte checksum context field before copying, so an over-long value is written past the end of the heap allocation (CWE-787; CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Because the attacker must already hold KSL client credentials and the written content is constrained to valid digest-name strings, the practical result is a crash or memory corruption of the logging service rather than reliable remote code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority availability risk pending a vendor fix.