PT-2007-2894 · Rhapsody · Rhapsody Irc

Starcadi · Publicado 2007-03-19 · Atualizado 2018-10-16 · CVE-2007-1503

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rhapsody IRC version 0.28b

Description The issue involves multiple format string vulnerabilities in the comm.c file. These vulnerabilities allow remote attackers to execute arbitrary code via format string specifiers to the create ctcp message function. The attack vectors include the me and ctcp commands, and possibly the whois, mode, and topic commands, by providing malicious input as the message argument.

Recommendations For Rhapsody IRC version 0.28b, consider disabling the create ctcp message function or restricting the use of the me and ctcp commands until a patch is available. Additionally, limiting the input to the whois, mode, and topic commands may help minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-1503

Produtos afetados

Rhapsody Irc

Referências · 5

• http://securityfocus.com/bid/23011 · Nota
• http://securityreason.com/securityalert/2447 · Nota
• http://osvdb.org/35001 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1503 · Nota de Segurança
• http://securityfocus.com/archive/1/463092/100/0/threaded · Nota