PT-2005-5250 · Unknown · Electric Sheep

Daniel Guido + 1 · Publicado 2005-12-29 · Atualizado 2018-10-19 · CVE-2005-4582

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Electric Sheep version 2.6.3

Description The issue allows remote attackers to download and display arbitrary MPEG movie files. This can be achieved through various means, including DNS spoofing, a URL on the command line, or a URL in the configuration file. The attack vectors are similar to those applicable to common web browsers communicating with untrusted web servers, which may indicate a broader issue related to DNS design. However, a client would reasonably expect to receive content only from the server.

Recommendations For Electric Sheep version 2.6.3, consider implementing authentication and integrity checks from the server to the client to prevent remote attackers from downloading and displaying arbitrary MPEG movie files. As a temporary workaround, restrict the ability to load content from untrusted sources, such as those obtained through DNS spoofing or unverified URLs.

Correção

Identificadores relacionados

CVE-2005-4582

Produtos afetados

Electric Sheep

Referências · 4

• http://securityreason.com/securityalert/295 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23892 · Nota
• http://securityfocus.com/archive/1/420161/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4582 · Nota de Segurança