PT-2005-5250 · Unknown · Electric Sheep

Daniel Guido + 1 · Published 2005-12-29 · Updated 2018-10-19 · CVE-2005-4582

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Electric Sheep version 2.6.3

Description The issue allows remote attackers to download and display arbitrary MPEG movie files. This can be achieved through various means, including DNS spoofing, a URL on the command line, or a URL in the configuration file. The attack vectors are similar to those applicable to common web browsers communicating with untrusted web servers, which may indicate a broader issue related to DNS design. However, a client would reasonably expect to receive content only from the server.

Recommendations For Electric Sheep version 2.6.3, consider implementing authentication and integrity checks from the server to the client to prevent remote attackers from downloading and displaying arbitrary MPEG movie files. As a temporary workaround, restrict the ability to load content from untrusted sources, such as those obtained through DNS spoofing or unverified URLs.

Fix

Related Identifiers

CVE-2005-4582

Affected Products

Electric Sheep

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4582 · Security Note
• http://securityreason.com/securityalert/295 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23892 · Note
• http://securityfocus.com/archive/1/420161/100/0/threaded · Note