PT-2007-3685 · Afflib · Afflib

Published 2007-04-30 · Updated 2018-10-16 · CVE-2007-2352

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AFFLIB version 2.2.6

Description The issue involves multiple format string vulnerabilities that allow remote attackers to execute arbitrary code via certain command line parameters. These parameters are used in warn and err calls, possibly involving files such as lib/s3.cpp, tools/afconvert.cpp, tools/afcopy.cpp, tools/afinfo.cpp, aimage/imager.cpp, and tools/afxml.cpp.

Recommendations For AFFLIB version 2.2.6, consider restricting the use of command line parameters that may be used in warn and err calls until a patch is available. As a temporary workaround, avoid using potentially vulnerable parameters in the affected files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2352

Affected Products

Afflib

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-2352 · Security Note
• http://vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt · Patch
• http://securityreason.com/securityalert/2657 · Note
• http://securityfocus.com/archive/1/467040/100/0/threaded · Note