PT-2009-2547 · Maxum · Rumpus

Publicado 2009-08-25 · Atualizado 2018-10-11 · CVE-2008-7078

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rumpus versions prior to 6.0.1

Description The issue is related to multiple buffer overflows that can be exploited by remote attackers to cause a denial of service, resulting in a segmentation fault, by sending a long HTTP verb in the HTTP component. Additionally, remote authenticated users can execute arbitrary code by providing a long argument to certain commands, including MKD, XMKD, and RMD, in the FTP component.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP component and limiting the length of arguments to the MKD, XMKD, and RMD commands until a patch is applied.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-7078

Produtos afetados

Rumpus

Referências · 10

• 🔥 http://securityfocus.com/bid/32560 · Exploit
• 🔥 https://exploit-db.com/exploits/7314 · Exploit
• 🔥 http://securityfocus.com/bid/32558 · Exploit
• http://secunia.com/advisories/32892 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0007.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46988 · Nota
• http://securityfocus.com/archive/1/498786/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46987 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7078 · Nota de Segurança
• http://maxum.com/Rumpus/News601.html · Nota