PT-2007-4042 · Bitscast · Bitscast

Gbr · Published 2007-05-16 · Updated 2017-10-11 · CVE-2007-2726

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BitsCast version 0.13.0

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash. This can be achieved by providing an RSS 2.0 feed item containing certain invalid strings in the pubDate element. Specifically, patterns such as repeated "../A" or "A/../" can trigger this behavior.

Recommendations For BitsCast version 0.13.0, consider validating or sanitizing the input for the pubDate element in RSS 2.0 feed items to prevent the application from crashing due to invalid strings. As a temporary workaround, restrict the processing of RSS 2.0 feed items containing suspicious patterns until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-2726

Affected Products

Bitscast

References · 5

• 🔥 https://exploit-db.com/exploits/3929 · Exploit
• 🔥 http://securityfocus.com/bid/23993 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2726 · Security Note
• http://osvdb.org/39767 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34344 · Note