PT-2005-1054 · Turquoise · Turquoise Superstat

Peter Karlsson · Published 2005-09-15 · Updated 2008-09-05 · CVE-2005-2658

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Turquoise SuperStat (turqstat) versions 2.2.4 and earlier

Description The issue is related to a buffer overflow in the utility.cpp file of Turquoise SuperStat, which could potentially allow remote NNTP servers to execute arbitrary code by sending a date with a long month. Additionally, there are multiple vulnerabilities in the xturqstat package that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For versions 2.2.4 and earlier, update to a version that fixes the buffer overflow issue in utility.cpp. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-04090

CVE-2005-2658

DSA-812-1

Affected Products

Turquoise Superstat

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-2658 · Security Note
• https://bdu.fstec.ru/vul/2015-04090 · Security Note
• http://debian.org/security/2005/dsa-812 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2658 · Security Note
• http://cvs.alioth.debian.org/cgi-bin/cvsweb.cgi/turqstat/utility.cpp.diff?cvsroot=turqstat&r2=1.41&r1=1.40&f=u · Note
• http://debian.org/security/dsa-812 · Note
• http://securityfocus.com/bid/14852 · Note