PT-2007-3039 · Datarescue · Datarescue Ida Pro

Published 2007-03-24 · Updated 2017-07-29 · CVE-2007-1666

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: DataRescue IDA Pro versions 5.0 through 5.1

Description: The issue concerns the processor request function in the debugger server, which fails to verify authentication before invoking the perform request function. This allows remote attackers to perform unauthorized actions.

Recommendations: For DataRescue IDA Pro versions 5.0 through 5.1, consider disabling the processor request function until a patch is available to prevent unauthorized actions. Restrict access to the debugger server to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-1666

Affected Products

Datarescue Ida Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-1666 · Security Note
• http://datarescue.com/freefiles/ida_remdeb_fix_22032007.zip · Patch
• http://secunia.com/advisories/24635 · Vendor Advisory
• http://vupen.com/english/advisories/2007/1089 · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities · Note
• http://securitytracker.com/id?1017815 · Note
• http://osvdb.org/33523 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33190 · Note
• http://securityfocus.com/bid/23114 · Note