PT-2008-1590 · Lscube · Lscube Feng

Luigi Auriemma · Publicado 2008-01-04 · Atualizado 2018-10-15 · CVE-2007-6627

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LScube Feng versions 0.1.15 and earlier

Description The issue is related to an integer overflow in the RTSP remove msg function, which can be triggered by a remote attacker sending an RTP packet with a size value of 0xffff. This can cause a denial of service (crash) and potentially allow the execution of arbitrary code.

Recommendations For versions 0.1.15 and earlier, consider disabling the RTSP remove msg function as a temporary workaround until a patch is available. Restrict access to the RTP packet handling module to minimize the risk of exploitation. Avoid using size values that could trigger the integer overflow in the affected function.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2007-6627

Produtos afetados

Lscube Feng

Referências · 9

• 🔥 http://securityfocus.com/bid/27049 · Exploit
• http://securityreason.com/securityalert/3507 · Nota
• http://securityfocus.com/archive/1/485574/100/0/threaded · Nota
• http://vupen.com/english/advisories/2008/0011 · Nota
• http://aluigi.altervista.org/adv/fengulo-adv.txt · Nota
• http://aluigi.org/poc/fengulo.zip · Nota
• http://secunia.com/advisories/28229 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6627 · Nota de Segurança
• http://osvdb.org/40533 · Nota