PT-2007-3397 · Afflib · Afflib

Publicado 2007-04-30 · Atualizado 2018-10-16 · CVE-2007-2054

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AFFLIB versions prior to 2.2.6

Description The issue allows remote attackers to execute arbitrary code via certain command line parameters. These parameters are used in warn and err calls within various files, including lib/s3.cpp, tools/afconvert.cpp, tools/afcopy.cpp, tools/afinfo.cpp, aimage/imager.cpp, and tools/afxml.cpp.

Recommendations For versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of command line parameters in the affected files until a patch is available. Avoid using potentially vulnerable command line parameters in the affected API endpoints or functions until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-2054

Produtos afetados

Afflib

Referências · 5

• http://vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt · Aviso do Fabricante
• http://securityreason.com/securityalert/2657 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33969 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2054 · Nota de Segurança
• http://securityfocus.com/archive/1/467040/100/0/threaded · Nota