PT-2007-2802 · Bartek Jasicki · Vallheru

Published 2007-03-10 · Updated 2008-09-05 · CVE-2007-1408

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bartek Jasicki Vallheru versions prior to 1.3 beta

Description The issue is related to multiple vulnerabilities in several PHP files, including bank.php, landfill.php, outposts.php, tribes.php, house.php, tribearmor.php, tribeastral.php, tribeware.php, and includes/head.php. These vulnerabilities may be related to large integer values containing more than 15 digits. The original vendor report mentions integer overflows, but this term might be used incorrectly. The vulnerabilities have unknown impact and can be exploited remotely.

Recommendations For versions prior to 1.3 beta, update to version 1.3 beta or later to resolve the issue. As a temporary workaround, consider restricting the input of large integer values in the affected PHP files until a patch is available. Avoid using the affected PHP files, such as bank.php, landfill.php, outposts.php, tribes.php, house.php, tribearmor.php, tribeastral.php, tribeware.php, and includes/head.php, for critical operations until the issue is resolved.

Fix

Related Identifiers

CVE-2007-1408

Affected Products

Vallheru

References · 4

• http://sourceforge.net/project/shownotes.php?release_id=491871&group_id=118350 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-1408 · Security Note
• http://sourceforge.net/forum/forum.php?forum_id=672237 · Note
• http://vallheru.svn.sourceforge.net/viewvc/vallheru/vallheru2/bank.php?r1=910&r2=918 · Note