PT-2007-5277 · Cstr · Cstr Festival

Publicado 2007-07-30 · Atualizado 2018-10-15 · CVE-2007-4074

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: CSTR Festival version 1.95 beta (aka 2.0 beta)

Description: The default configuration of CSTR Festival allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, due to it running with elevated privileges without requiring authentication. This issue can be local in some environments but remote in others.

Recommendations: For version 1.95 beta (aka 2.0 beta), consider disabling the daemon on port 1314 until a proper configuration or patch is available to prevent unauthorized access and command execution. Restrict access to the daemon to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2007-4074

Produtos afetados

Cstr Festival

Referências · 12

• http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35606 · Nota
• http://security.gentoo.org/glsa/glsa-200707-10.xml · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=170477 · Nota
• http://securityfocus.com/bid/25069 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4074 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2007-4074 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4074 · Nota de Segurança
• http://securityfocus.com/archive/1/490465/100/0/threaded · Nota
• http://secunia.com/advisories/27271 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2007-4074 · Aviso do Fabricante
• http://secunia.com/advisories/26229 · Aviso do Fabricante