PT-2007-3396 · Afflib · Afflib

Timothy D. Morgan · Publicado 2007-04-30 · Atualizado 2018-10-16 · CVE-2007-2053

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AFFLIB versions prior to 2.2.6

Description The issue is caused by multiple stack-based buffer overflows, which can lead to a denial of service (crash) or possibly allow remote attackers to execute arbitrary code. This can occur through various means, including a long LastModified value in an S3 XML response, a long path or bucket in an S3 URL, or a long EFW, AFD, or certain file paths.

Recommendations For versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/s3.cpp and lib/vnode s3.cpp components to minimize the risk of exploitation. Avoid using long values for LastModified, path, bucket, EFW, AFD, or file paths in affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-2053

Produtos afetados

Afflib

Referências · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/33961 · Nota
• http://securityfocus.com/archive/1/467038/100/0/threaded · Nota
• http://osvdb.org/35615 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2053 · Nota de Segurança
• http://securityfocus.com/bid/23695 · Correção
• http://osvdb.org/35613 · Nota
• http://securityreason.com/securityalert/2655 · Nota
• http://vsecurity.com/bulletins/advisories/2007/afflib-overflows.txt · Aviso do Fabricante
• http://osvdb.org/35614 · Nota