PT-2007-6348 · Unknown · Dawn Of Time

Publicado 2007-10-08 · Atualizado 2018-10-15 · CVE-2007-5265

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Dawn of Time versions 1.69s beta4 and earlier

Description: The issue allows remote attackers to execute arbitrary code via format string specifiers in the username or password fields when accessing certain restricted zones. The processWebHeader and filterWebRequest functions do not properly handle these fields.

Recommendations: For Dawn of Time versions 1.69s beta4 and earlier, as a temporary workaround, consider restricting access to the restricted zones until a patch is available. Avoid using format string specifiers in the username and password fields. Restrict the use of the processWebHeader and filterWebRequest functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2007-5265

Produtos afetados

Dawn Of Time

Referências · 10

• 🔥 https://exploit-db.com/exploits/30644 · Exploit
• 🔥 http://aluigi.altervista.org/adv/dawnfs-adv.txt · Exploit
• 🔥 http://securityfocus.com/bid/25944 · Exploit
• http://securityfocus.com/archive/1/481619/100/0/threaded · Nota
• http://secunia.com/advisories/27083 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36973 · Nota
• http://vupen.com/english/advisories/2007/3418 · Nota
• http://securityreason.com/securityalert/3201 · Nota
• http://forums.dawnoftime.org/viewtopic.php?t=2102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5265 · Nota de Segurança