PT-2008-6409 · Zilab · Zilab Chat/Instant Messaging (Zim) Server

Publicado 2008-11-29 · Atualizado 2011-03-08 · CVE-2008-5279

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zilab Chat and Instant Messaging (ZIM) Server versions 2.1 and earlier

Description The issue allows remote attackers to execute arbitrary code via heap-based buffer overflows involving multiple vectors, including a long room name and a long source account, and a stack-based buffer overflow with a long username in an information request.

Recommendations For Zilab Chat and Instant Messaging (ZIM) Server versions 2.1 and earlier, consider restricting access to the Local ZIM Server (zcs.exe) to minimize the risk of exploitation. As a temporary workaround, avoid using long room names and long source accounts, and restrict the use of long username in information requests until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-5279

Produtos afetados

Zilab Chat/Instant Messaging (Zim) Server

Referências · 6

• 🔥 http://aluigi.org/poc/zilabzcsx.zip · Exploit
• 🔥 http://securityfocus.com/bid/27940 · Exploit
• http://vupen.com/english/advisories/2008/0664 · Nota
• http://secunia.com/advisories/29062 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5279 · Nota de Segurança
• http://aluigi.altervista.org/adv/zilabzcsx-adv.txt · Nota