PT-2005-4729 · Unknown · Wineggdropshell

Sowhat · Published 2005-12-04 · Updated 2008-09-05 · CVE-2005-3992

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WinEggDropShell remote access trojan (RAT) version 1.7

Description The issue allows remote attackers to execute arbitrary code due to multiple buffer overflows. This can be achieved via a long GET request to the "HTTP server" endpoint, or a long USER or PASS command to the "FTP server" endpoint.

Recommendations For WinEggDropShell remote access trojan (RAT) version 1.7, consider disabling the HTTP server and FTP server until a patch is available to prevent exploitation. Restrict access to the USER and PASS commands in the FTP server to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2005-3992

Affected Products

Wineggdropshell

References · 7

• 🔥 http://securityfocus.com/bid/15682 · Exploit
• 🔥 https://exploit-db.com/exploits/1353 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0059.html · Exploit
• 🔥 http://securityfocus.com/archive/1/418398 · Exploit
• http://secway.org/advisory/AD20051202.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3992 · Security Note
• http://securityreason.com/securityalert/226 · Note