PT-2007-3970 · Free-Sa · Free-Sa

Published 2007-05-14 · Updated 2017-07-29 · CVE-2007-2652

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Free-SA versions prior to 1.2.2

Description The issue involves multiple unspecified vulnerabilities that allow remote attackers to execute arbitrary code. These vulnerabilities are related to certain sprintf and vsprintf calls in various files, including those in the reports/ and work/ directories. The files affected include r index.c, r reports.c, r topsites.c, r topuser.c, r typical.c, r userdatetime.c, r users.c, w fs.c, w internal.c, and w log operations.c. The vulnerabilities are probably related to buffer overflows.

Recommendations For Free-SA versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected files and directories until a patch is applied. Avoid using the sprintf and vsprintf functions in the affected files until the issue is resolved.

Fix

Related Identifiers

CVE-2007-2652

Affected Products

Free-Sa

References · 5

• http://sourceforge.net/project/shownotes.php?release_id=500691&group_id=191513 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-2652 · Security Note
• http://securityfocus.com/bid/23924 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34218 · Note
• http://vupen.com/english/advisories/2007/1757 · Note