PT-2007-1013 · Unicon · Unicon-Imc2

Published 2007-07-03 · Updated 2017-07-29 · CVE-2007-2835

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: unicon-imc2 version 3.0.4

Description: The issue involves multiple stack-based buffer overflows in files CCE pinyin.c and xl pinyin.c within the ImmModules/cce/ directory of unicon-imc2. This allows local users, who have already authenticated, to potentially gain privileges by manipulating the HOME environment variable. The exploitation of these vulnerabilities can lead to breaches of confidentiality, integrity, and availability of protected information.

Recommendations: For unicon-imc2 version 3.0.4, consider restricting access to sensitive areas of the system to minimize the risk of exploitation until a patch is available. As a temporary workaround, limiting the length of the HOME environment variable could help mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-02185

CVE-2007-2835

DSA-1328-1

Affected Products

Unicon-Imc2

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2007-2835 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-2835 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2835 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02185 · Security Note
• http://debian.org/security/2007/dsa-1328 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2835 · Security Note
• https://osv.dev/vulnerability/CVE-2007-2835 · Vendor Advisory
• http://debian.org/security/dsa-1328 · Note
• http://securityfocus.com/bid/24719 · Note
• http://secunia.com/advisories/25912 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35382 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=431336 · Note
• http://osvdb.org/37794 · Note
• http://secunia.com/advisories/25910 · Note