PT-2007-3685 · Afflib · Afflib

Publicado 2007-04-30 · Atualizado 2018-10-16 · CVE-2007-2352

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AFFLIB version 2.2.6

Description The issue involves multiple format string vulnerabilities that allow remote attackers to execute arbitrary code via certain command line parameters. These parameters are used in warn and err calls, possibly involving files such as lib/s3.cpp, tools/afconvert.cpp, tools/afcopy.cpp, tools/afinfo.cpp, aimage/imager.cpp, and tools/afxml.cpp.

Recommendations For AFFLIB version 2.2.6, consider restricting the use of command line parameters that may be used in warn and err calls until a patch is available. As a temporary workaround, avoid using potentially vulnerable parameters in the affected files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-2352

Produtos afetados

Afflib

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-2352 · Nota de Segurança
• http://securityreason.com/securityalert/2657 · Nota
• http://securityfocus.com/archive/1/467040/100/0/threaded · Nota
• http://vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt · Correção