PT-2007-1633 · Omni · Omniweb

Moab · Published 2007-01-09 · Updated 2018-10-16 · CVE-2007-0148

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OmniWeb version 5.5.1

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, or execute arbitrary code. This is achieved through the use of format string specifiers in the Javascript alert function.

Recommendations For OmniWeb version 5.5.1, consider disabling the Javascript alert function as a temporary workaround until a patch is available. Restrict access to untrusted Javascript code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2007-0148

Affected Products

Omniweb

References · 12

• 🔥 https://exploit-db.com/exploits/3098 · Exploit
• http://omnigroup.com/applications/omniweb/releasenotes · Patch
• http://projects.info-pull.com/moab/MOAB-07-01-2007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0148 · Security Note
• http://secunia.com/advisories/23624 · Vendor Advisory
• http://digitalmunition.com/DMA%5B2007-0107a%5D.txt · Note
• http://securityfocus.com/bid/21911 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31324 · Note
• http://vupen.com/english/advisories/2007/0075 · Note
• http://securityfocus.com/archive/1/456578/100/0/threaded · Note
• http://osvdb.org/31222 · Note
• http://blog.omnigroup.com/2007/01/07/omniweb-552-now-available-and-more-secure · Note