PT-2007-5176 · Teamspeak · Teamspeak Webserver

Yag Kohha · Published 2007-07-24 · Updated 2017-09-29 · CVE-2007-3956

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: TeamSpeak WebServer version 2.0 for Windows

Description: The issue allows remote attackers to cause a denial of service, consuming CPU and memory, by sending requests with long username and password parameters to the "login.tscmd" endpoint on TCP port 14534. This is due to the lack of validation of parameter value lengths and the failure to expire TCP sessions.

Recommendations: For TeamSpeak WebServer version 2.0 for Windows, consider restricting access to the "login.tscmd" endpoint on TCP port 14534 to minimize the risk of exploitation. As a temporary workaround, restrict the length of username and password parameters to prevent excessive CPU and memory consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-3956

Affected Products

Teamspeak Webserver

References · 7

• 🔥 https://exploit-db.com/exploits/4205 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3956 · Security Note
• http://osvdb.org/38595 · Note
• http://secunia.com/advisories/26141 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3956 · Note
• http://securityfocus.com/bid/24977 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35518 · Note