PT-2007-2802 · Bartek Jasicki · Vallheru

Publicado 2007-03-10 · Atualizado 2008-09-05 · CVE-2007-1408

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bartek Jasicki Vallheru versions prior to 1.3 beta

Description The issue is related to multiple vulnerabilities in several PHP files, including bank.php, landfill.php, outposts.php, tribes.php, house.php, tribearmor.php, tribeastral.php, tribeware.php, and includes/head.php. These vulnerabilities may be related to large integer values containing more than 15 digits. The original vendor report mentions integer overflows, but this term might be used incorrectly. The vulnerabilities have unknown impact and can be exploited remotely.

Recommendations For versions prior to 1.3 beta, update to version 1.3 beta or later to resolve the issue. As a temporary workaround, consider restricting the input of large integer values in the affected PHP files until a patch is available. Avoid using the affected PHP files, such as bank.php, landfill.php, outposts.php, tribes.php, house.php, tribearmor.php, tribeastral.php, tribeware.php, and includes/head.php, for critical operations until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-1408

Produtos afetados

Vallheru

Referências · 4

• http://sourceforge.net/forum/forum.php?forum_id=672237 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=491871&group_id=118350 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-1408 · Nota de Segurança
• http://vallheru.svn.sourceforge.net/viewvc/vallheru/vallheru2/bank.php?r1=910&r2=918 · Nota