PT-2008-3309 · Roni Music · Firefly Media Server

Publicado 2008-04-16 · Atualizado 2017-08-08 · CVE-2008-1771

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefly Media Server versions 0.2.4.1

Description The issue is caused by an integer overflow in the ws getpostvars function, allowing remote attackers to potentially execute arbitrary code or cause a denial of service via an HTTP POST request with a large Content-Length.

Recommendations For Firefly Media Server version 0.2.4.1, consider restricting access to the ws getpostvars function until a patch is available. As a temporary workaround, limit the size of HTTP POST requests to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-1771

DSA-1597-1

Produtos afetados

Firefly Media Server

Referências · 12

• http://securitytracker.com/id?1019908 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41850 · Nota
• http://secunia.com/advisories/30661 · Nota
• http://securityfocus.com/bid/28860 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1771 · Nota de Segurança
• http://sourceforge.net/project/shownotes.php?release_id=593465&group_id=98211 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476241 · Nota
• http://debian.org/security/2008/dsa-1597 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/1303/references · Nota
• https://redhat.com/archives/fedora-package-announce/2008-April/msg00446.html · Aviso do Fabricante
• http://secunia.com/advisories/29917 · Nota
• http://secunia.com/advisories/29919 · Nota