PT-2007-5341 · Bluesky · Blueskycat

Publicado 2007-08-03 · Atualizado 2018-10-15 · CVE-2007-4145

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions BlueSkyCat version 8.1.2.0 and earlier

Description The issue is related to a heap-based buffer overflow in the BlueSkychat ActiveX control. This can be exploited by remote attackers to execute arbitrary code via a long string in the second argument to the ConnecttoServer method.

Recommendations For versions 8.1.2.0 and earlier, as a temporary workaround, consider disabling the ConnecttoServer method until a patch is available. Restrict access to the vulnerable ActiveX control V2.V2Ctrl.1 to minimize the risk of exploitation. Avoid using long strings in the second argument to the ConnecttoServer method until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-4145

Produtos afetados

Blueskycat

Referências · 9

• 🔥 https://exploit-db.com/exploits/30441 · Exploit
• 🔥 http://securityfocus.com/bid/25149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4145 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064995.html · Nota
• http://codeaudit.blogspot.com · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35699 · Nota
• http://securityreason.com/securityalert/2959 · Nota
• http://securityfocus.com/archive/1/475150/100/0/threaded · Nota
• http://vulnhunt.com/advisories/CAL-20070730-1_BlueSkyCat_v2.ocx_ActiveX_remote_heap_overflow_vulnerability_en.txt · Nota