PT-2007-3421 · Php+2 · Php+2

Retrogod · Publicado 2007-04-18 · Atualizado 2017-10-11 · CVE-2007-2079

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XAMPP versions 1.6.0a and earlier

Description The issue concerns the ADONewConnection Connect function in adodb.php, which uses untrusted input for the database server hostname. This allows remote attackers to potentially trigger a library buffer overflow and execute arbitrary code via a long host parameter. The impact of this issue could also be unspecified.

Recommendations For XAMPP versions 1.6.0a and earlier, consider updating to a newer version that addresses this issue, although the exact fix might be argued to be in other products such as PHP or the ADOdb Library. As a temporary workaround, restrict the input for the database server hostname to prevent potential buffer overflow attacks.

Exploit

Correção

Identificadores relacionados

CVE-2007-2079

Produtos afetados

Adodb Library

Php

Xampp

Referências · 6

• 🔥 https://exploit-db.com/exploits/3738 · Exploit
• http://osvdb.org/41594 · Nota
• http://securityfocus.com/bid/23491 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2079 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33683 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2079 · Nota