PT-2007-1633 · Omni · Omniweb

Moab · Publicado 2007-01-09 · Atualizado 2018-10-16 · CVE-2007-0148

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OmniWeb version 5.5.1

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, or execute arbitrary code. This is achieved through the use of format string specifiers in the Javascript alert function.

Recommendations For OmniWeb version 5.5.1, consider disabling the Javascript alert function as a temporary workaround until a patch is available. Restrict access to untrusted Javascript code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2007-0148

Produtos afetados

Omniweb

Referências · 12

• 🔥 https://exploit-db.com/exploits/3098 · Exploit
• http://omnigroup.com/applications/omniweb/releasenotes · Correção
• http://projects.info-pull.com/moab/MOAB-07-01-2007.html · Aviso do Fabricante
• http://digitalmunition.com/DMA%5B2007-0107a%5D.txt · Nota
• http://securityfocus.com/bid/21911 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31324 · Nota
• http://vupen.com/english/advisories/2007/0075 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0148 · Nota de Segurança
• http://securityfocus.com/archive/1/456578/100/0/threaded · Nota
• http://osvdb.org/31222 · Nota
• http://secunia.com/advisories/23624 · Aviso do Fabricante
• http://blog.omnigroup.com/2007/01/07/omniweb-552-now-available-and-more-secure · Nota