PT-2008-3265 · Tumbleweed · Tumbleweed Securetransport Server

Patrick Webster · Publicado 2008-04-11 · Atualizado 2018-10-11 · CVE-2008-1724

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tumbleweed SecureTransport Server version 1.0.0.5

Description The issue is related to a stack-based buffer overflow in the IActiveXTransfer.FileTransfer method within the SecureTransport FileTransfer ActiveX control. This occurs when a long remoteFile parameter is passed, allowing remote attackers to execute arbitrary code.

Recommendations For version 1.0.0.5, update to Tumbleweed SecureTransport Server 4.6.1 Hotfix 20 or later to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-1724

Produtos afetados

Tumbleweed Securetransport Server

Referências · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/tumbleweed_filetransfer.rb · Exploit
• 🔥 http://securityreason.com/securityalert/3806 · Exploit
• 🔥 https://exploit-db.com/exploits/16563 · Exploit
• 🔥 https://exploit-db.com/exploits/5398 · Exploit
• 🔥 http://securityfocus.com/bid/28662 · Exploit
• http://vupen.com/english/advisories/2008/1165/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1724 · Nota de Segurança
• http://securityfocus.com/archive/1/490536/100/0/threaded · Nota
• http://aushack.com/200708-tumbleweed.txt · Nota
• http://secunia.com/advisories/29717 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41692 · Nota