PT-2007-5243 · Guidance · Encase

Published 2007-07-27 · Updated 2024-08-07 · CVE-2007-4035

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Guidance Software EnCase (affected versions not specified)

Description: The issue arises from the improper handling of certain malformed MBR partition tables and NTFS filesystems. This allows remote attackers to prevent the logical collection of a disk image or examination of certain directory contents. Specifically, the software does not handle (1) certain malformed MBR partition tables with many entries, (2) NTFS filesystems with directory loops, and (3) certain other malformed NTFS filesystems. The vendor disputes the significance of these issues, citing that physical collection can be used instead and that detection of a loop is valuable on its own.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-4035

Affected Products

Encase

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-4035 · Security Note
• http://securityfocus.com/archive/1/474750/100/0/threaded · Note
• http://blackhat.com/html/bh-usa-07/bh-usa-07-speakers.html#Palmer · Note
• http://securityfocus.com/archive/1/474809/100/0/threaded · Note
• http://securityfocus.com/bid/25100 · Note
• http://securityfocus.com/archive/1/475335/100/0/threaded · Note
• https://t.me/cvenotify/89686 · Telegram Post
• http://isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf · Note
• http://securityfocus.com/archive/1/474727/100/0/threaded · Note