PT-2007-1998 · Telligent · Telligent Community Server

Published 2007-01-29 · Updated 2018-10-16 · CVE-2007-0538

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Telligent Community Server versions 2.1 and earlier

Description The issue allows remote attackers to cause a denial of service, either by consuming bandwidth or threads, via pingback service calls. This can be achieved by making pingback service calls with a source URI that corresponds to a large file, triggering a long download session without a timeout constraint, or a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.

Recommendations For versions 2.1 and earlier, consider disabling the pingback service as a temporary workaround until a patch is available. Restrict access to the pingback service to minimize the risk of exploitation. Avoid using the pingback service for files with binary content types or large files until the issue is resolved.

Fix

Related Identifiers

CVE-2007-0538

Affected Products

Telligent Community Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0538 · Security Note
• http://securityfocus.com/archive/1/457999/100/0/threaded · Note
• http://osvdb.org/33583 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0538 · Note
• http://securityreason.com/securityalert/2211 · Note
• http://osvdb.org/33584 · Note
• http://securityfocus.com/archive/1/457996/100/0/threaded · Note