PT-2007-3396 · Afflib · Afflib

Timothy D. Morgan · Published 2007-04-30 · Updated 2018-10-16 · CVE-2007-2053

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AFFLIB versions prior to 2.2.6

Description The issue is caused by multiple stack-based buffer overflows, which can lead to a denial of service (crash) or possibly allow remote attackers to execute arbitrary code. This can occur through various means, including a long LastModified value in an S3 XML response, a long path or bucket in an S3 URL, or a long EFW, AFD, or certain file paths.

Recommendations For versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/s3.cpp and lib/vnode s3.cpp components to minimize the risk of exploitation. Avoid using long values for LastModified, path, bucket, EFW, AFD, or file paths in affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2007-2053

Affected Products

Afflib

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-2053 · Security Note
• http://securityfocus.com/bid/23695 · Patch
• http://vsecurity.com/bulletins/advisories/2007/afflib-overflows.txt · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33961 · Note
• http://securityfocus.com/archive/1/467038/100/0/threaded · Note
• http://osvdb.org/35615 · Note
• http://osvdb.org/35613 · Note
• http://securityreason.com/securityalert/2655 · Note
• http://osvdb.org/35614 · Note