PT-2007-5628 · Nabi Studios · Toribash

Publicado 2007-08-21 · Atualizado 2018-10-15 · CVE-2007-4447

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Toribash versions 2.71 and earlier

Description The issue concerns multiple buffer overflows in the client. These overflows can be triggered by remote attackers via a long game command in a replay (.rpl) file, allowing them to execute arbitrary code, or by a long SAY command that omits a required LF character, leading to a denial of service (application crash). Additionally, remote Toribash servers can execute arbitrary code via a long game command or a long SAY command that omits a required LF character.

Recommendations For Toribash versions 2.71 and earlier, update to a version later than 2.71 to resolve the issue. At the moment, there is no information about other specific fixes for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2007-4447

Produtos afetados

Toribash

Referências · 7

• 🔥 http://securityfocus.com/bid/25359 · Exploit
• 🔥 http://aluigi.org/poc/toribashish.zip · Exploit
• http://securityreason.com/securityalert/3033 · Nota
• http://securityfocus.com/archive/1/477025/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4447 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36097 · Nota
• http://secunia.com/advisories/26507 · Aviso do Fabricante