PT-2007-5238 · Areca · Areca Cli

Published 2007-07-26 · Updated 2018-10-15 · CVE-2007-4027

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Areca CLI versions 1.72.250 and earlier

Description: A buffer overflow issue exists in the cli32 component of Areca CLI, potentially allowing local users to gain privileges through a long argument. It is noted that the program is not setuid by default, but there are specific usage scenarios where an administrator might configure it as setuid.

Recommendations: For Areca CLI versions 1.72.250 and earlier, consider restricting access to the cli32 component until a fix is available. As a temporary workaround, avoid using long arguments with the cli32 component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-4027

Affected Products

Areca Cli

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-4027 · Security Note
• http://securityreason.com/securityalert/2928 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35546 · Note
• http://osvdb.org/38999 · Note
• http://devtarget.org/areca-advisory-07-2007.txt · Note
• http://securityfocus.com/archive/1/474415/100/0/threaded · Note