PT-2007-1998 · Telligent · Telligent Community Server

Publicado 2007-01-29 · Atualizado 2018-10-16 · CVE-2007-0538

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Telligent Community Server versions 2.1 and earlier

Description The issue allows remote attackers to cause a denial of service, either by consuming bandwidth or threads, via pingback service calls. This can be achieved by making pingback service calls with a source URI that corresponds to a large file, triggering a long download session without a timeout constraint, or a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.

Recommendations For versions 2.1 and earlier, consider disabling the pingback service as a temporary workaround until a patch is available. Restrict access to the pingback service to minimize the risk of exploitation. Avoid using the pingback service for files with binary content types or large files until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-0538

Produtos afetados

Telligent Community Server

Referências · 7

• http://securityfocus.com/archive/1/457999/100/0/threaded · Nota
• http://osvdb.org/33583 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0538 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0538 · Nota de Segurança
• http://securityreason.com/securityalert/2211 · Nota
• http://osvdb.org/33584 · Nota
• http://securityfocus.com/archive/1/457996/100/0/threaded · Nota