PT-2010-3673 · Sblim · Sblim-Sfcb

Chris Buccella · Publicado 2010-06-14 · Atualizado 2023-02-13 · CVE-2010-2054

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SBLIM SFCB versions 1.3.4 through 1.3.7

Description The issue is related to an integer overflow in the httpAdapter.c component of SBLIM SFCB. This occurs when the configuration sets httpMaxContentLength to a zero value, allowing remote attackers to potentially cause a denial of service or execute arbitrary code by sending a large integer in the Content-Length HTTP header.

Recommendations For SBLIM SFCB versions 1.3.4 through 1.3.7, consider setting a non-zero value for httpMaxContentLength to prevent exploitation. Additionally, as a temporary workaround, restrict access to the httpAdapter component until a patch is available.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2010-2054

Produtos afetados

Sblim-Sfcb

Referências · 6

• http://sourceforge.net/tracker/index.php?func=detail&aid=3001915&group_id=128809&atid=712784 · Nota
• http://sblim.cvs.sourceforge.net/viewvc/sblim/sfcb/httpAdapter.c?r1=1.85&r2=1.86 · Nota
• http://vupen.com/english/advisories/2010/1312 · Aviso do Fabricante
• http://secunia.com/advisories/40018 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2054 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=127549079109192&w=2 · Nota