PT-2006-1540 · Shareaza · Shareaza

Ryan Smith · Published 2006-01-31 · Updated 2018-10-19 · CVE-2006-0474

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shareaza version 2.2.1.0

Description The issue is caused by multiple integer overflows that allow remote attackers to execute arbitrary code. This can occur via a large packet length field, which causes an overflow in the ReadBuffer function in files BTPacket.cpp and EDPacket.cpp, or a large packet, which causes a heap-based overflow in the Write function in Packet.h.

Recommendations For Shareaza version 2.2.1.0, consider disabling the ReadBuffer function and the Write function in Packet.h as a temporary workaround until a patch is available. Restrict access to the affected files BTPacket.cpp and EDPacket.cpp to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-0474

Affected Products

Shareaza

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-0474 · Security Note
• http://hustlelabs.com/shareaza_advisory.pdf · Vendor Advisory
• http://securityfocus.com/bid/16399 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0887.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24343 · Note
• http://securityreason.com/securityalert/382 · Note
• http://securityfocus.com/archive/1/423293/100/0/threaded · Note
• http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/EDPacket.cpp?r1=1.15&r2=1.15.2.1 · Note
• http://cvs.sourceforge.net/viewcvs.py/shareaza/shareaza/BTPacket.cpp?r1=1.5&r2=1.5.4.1 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24342 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24344 · Note