PT-2007-4042 · Bitscast · Bitscast

Gbr · Publicado 2007-05-16 · Atualizado 2017-10-11 · CVE-2007-2726

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BitsCast version 0.13.0

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash. This can be achieved by providing an RSS 2.0 feed item containing certain invalid strings in the pubDate element. Specifically, patterns such as repeated "../A" or "A/../" can trigger this behavior.

Recommendations For BitsCast version 0.13.0, consider validating or sanitizing the input for the pubDate element in RSS 2.0 feed items to prevent the application from crashing due to invalid strings. As a temporary workaround, restrict the processing of RSS 2.0 feed items containing suspicious patterns until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-2726

Produtos afetados

Bitscast

Referências · 5

• 🔥 https://exploit-db.com/exploits/3929 · Exploit
• 🔥 http://securityfocus.com/bid/23993 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2726 · Nota de Segurança
• http://osvdb.org/39767 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34344 · Nota