PT-2007-2463 · Getid3+1 · Getid3+1

Published 2007-02-21 · Updated 2017-07-29 · CVE-2007-1035

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: getID3 version 1.7.1

Description: The issue allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files. This is due to an unspecified vulnerability in certain demonstration scripts in getID3, as used in the Mediafield and Audio modules for Drupal.

Recommendations: For getID3 version 1.7.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1035

Affected Products

Drupal

Getid3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-1035 · Security Note
• http://securityfocus.com/bid/22587 · Patch
• http://drupal.org/node/119385 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32542 · Note
• http://vupen.com/english/advisories/2007/0635 · Note
• http://osvdb.org/35161 · Note
• http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module · Note