PT-2007-3970 · Free-Sa · Free-Sa

Publicado 2007-05-14 · Atualizado 2017-07-29 · CVE-2007-2652

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Free-SA versions prior to 1.2.2

Description The issue involves multiple unspecified vulnerabilities that allow remote attackers to execute arbitrary code. These vulnerabilities are related to certain sprintf and vsprintf calls in various files, including those in the reports/ and work/ directories. The files affected include r index.c, r reports.c, r topsites.c, r topuser.c, r typical.c, r userdatetime.c, r users.c, w fs.c, w internal.c, and w log operations.c. The vulnerabilities are probably related to buffer overflows.

Recommendations For Free-SA versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected files and directories until a patch is applied. Avoid using the sprintf and vsprintf functions in the affected files until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-2652

Produtos afetados

Free-Sa

Referências · 5

• http://securityfocus.com/bid/23924 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34218 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=500691&group_id=191513 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-2652 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1757 · Nota