PT-2007-5277 · Cstr · Cstr Festival

Published 2007-07-30 · Updated 2018-10-15 · CVE-2007-4074

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: CSTR Festival version 1.95 beta (aka 2.0 beta)

Description: The default configuration of CSTR Festival allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, due to it running with elevated privileges without requiring authentication. This issue can be local in some environments but remote in others.

Recommendations: For version 1.95 beta (aka 2.0 beta), consider disabling the daemon on port 1314 until a proper configuration or patch is available to prevent unauthorized access and command execution. Restrict access to the daemon to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2007-4074

Affected Products

Cstr Festival

References · 12

• http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200707-10.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4074 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-4074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4074 · Security Note
• http://secunia.com/advisories/27271 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4074 · Vendor Advisory
• http://secunia.com/advisories/26229 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35606 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=170477 · Note
• http://securityfocus.com/bid/25069 · Note
• http://securityfocus.com/archive/1/490465/100/0/threaded · Note