PT-2007-2672 · Netrek · Netrek Vanilla Server

Publicado 2007-03-03 · Atualizado 2018-10-16 · CVE-2007-1251

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netrek Vanilla Server version 2.12.0

Description The issue is related to a format string vulnerability in the new warning function. This vulnerability can be exploited by remote attackers to cause a denial of service or execute arbitrary code via format string specifiers in the message handling when EVENTLOG is enabled.

Recommendations For Netrek Vanilla Server version 2.12.0, consider disabling the EVENTLOG feature to minimize the risk of exploitation until a patch is available. Restrict access to the new warning function in ntserv/warning.c to prevent potential attacks.

Exploit

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2007-1251

Produtos afetados

Netrek Vanilla Server

Referências · 9

• 🔥 http://aluigi.altervista.org/adv/netrekfs-adv.txt · Exploit
• 🔥 https://exploit-db.com/exploits/3399 · Exploit
• http://sourceforge.net/project/shownotes.php?release_id=490561 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1251 · Nota de Segurança
• http://securityfocus.com/archive/1/461755/100/0/threaded · Nota
• http://securityfocus.com/bid/22786 · Nota
• http://secunia.com/advisories/24357 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32777 · Nota
• http://vupen.com/english/advisories/2007/0815 · Nota