PT-2008-2928 · Motum · Timbuktu Pro

Publicado 2008-03-14 · Atualizado 2018-10-11 · CVE-2008-1337

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Timbuktu Pro versions 8.6.5 RC 229 and earlier

Description The issue affects the instant message service, allowing remote attackers to cause a denial of service. This can happen in two ways: (1) by sending an invalid Version field, which can cause the daemon to crash, or (2) by sending an invalid or partial message, leading to CPU consumption and eventual daemon termination.

Recommendations For Timbuktu Pro versions 8.6.5 RC 229 and earlier, consider disabling the instant message service until a fix is available to prevent potential denial of service attacks.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-1337

Produtos afetados

Timbuktu Pro

Referências · 7

• 🔥 http://aluigi.org/poc/timbuto.zip · Exploit
• http://vupen.com/english/advisories/2008/0840 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1337 · Nota de Segurança
• http://securityreason.com/securityalert/3741 · Nota
• http://aluigi.altervista.org/adv/timbuto-adv.txt · Nota
• http://secunia.com/advisories/29316 · Aviso do Fabricante
• http://securityfocus.com/archive/1/489360/100/0/threaded · Nota