PT-2010-2863 · Open Direct Connect · Open Direct Connect Hub

Jan Lieskovsky + 1 · Publicado 2010-04-06 · Atualizado 2010-05-08 · CVE-2010-1147

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Direct Connect Hub version 0.8.1

Description The issue is a stack-based buffer overflow that allows remote authenticated users to execute arbitrary code via a long MyINFO message.

Recommendations For Open Direct Connect Hub version 0.8.1, consider restricting the length of MyINFO messages to prevent exploitation until a patch is available.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-1147

Produtos afetados

Open Direct Connect Hub

Referências · 15

• 🔥 http://securityfocus.com/archive/1/510428 · Exploit
• 🔥 https://exploit-db.com/exploits/11986 · Exploit
• 🔥 http://indahax.com/exploits/opendchub-0-8-1-remote-code-execution-exploit#more-600 · Exploit
• http://openwall.com/lists/oss-security/2010/04/03/1 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040360.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1044 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040380.html · Aviso do Fabricante
• http://secunia.com/advisories/39664 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=579206 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1147 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040421.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1023 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576308 · Nota
• http://marc.info/?l=oss-security&m=127051570728944&w=2 · Nota
• http://securityfocus.com/bid/39129 · Nota