PT-2007-5347 · Visionsoft · Visionsoft Audit

Publicado 2007-08-03 · Atualizado 2008-11-15 · CVE-2007-4151

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visionsoft Audit version 12.4.0.0

Description The issue allows remote attackers to obtain sensitive information. This can be achieved through three methods: (1) a LOG.ON command, which reveals the logging pathname in the server response, (2) a VER command, which reveals the version number in the server response, and (3) a connection, which reveals the version number in the banner.

Recommendations For Visionsoft Audit version 12.4.0.0, consider restricting access to the LOG.ON and VER commands to minimize the risk of exploitation. Additionally, restrict access to the connection banner to prevent version number disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-4151

Produtos afetados

Visionsoft Audit

Referências · 7

• http://portcullis.co.uk/uplds/advisories/vapathdisclosure%2006-043.txt · Nota
• http://securityfocus.com/bid/25153 · Nota
• http://osvdb.org/46982 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4151 · Nota de Segurança
• http://osvdb.org/46981 · Nota
• http://osvdb.org/46983 · Nota
• http://portcullis.co.uk/uplds/advisories/vaversiondisclosure%2006_046.txt · Nota