PT-2007-5341 · Bluesky · Blueskycat

Published 2007-08-03 · Updated 2018-10-15 · CVE-2007-4145

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions BlueSkyCat version 8.1.2.0 and earlier

Description The issue is related to a heap-based buffer overflow in the BlueSkychat ActiveX control. This can be exploited by remote attackers to execute arbitrary code via a long string in the second argument to the ConnecttoServer method.

Recommendations For versions 8.1.2.0 and earlier, as a temporary workaround, consider disabling the ConnecttoServer method until a patch is available. Restrict access to the vulnerable ActiveX control V2.V2Ctrl.1 to minimize the risk of exploitation. Avoid using long strings in the second argument to the ConnecttoServer method until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-4145

Affected Products

Blueskycat

References · 9

• 🔥 https://exploit-db.com/exploits/30441 · Exploit
• 🔥 http://securityfocus.com/bid/25149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4145 · Security Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064995.html · Note
• http://codeaudit.blogspot.com · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35699 · Note
• http://securityreason.com/securityalert/2959 · Note
• http://securityfocus.com/archive/1/475150/100/0/threaded · Note
• http://vulnhunt.com/advisories/CAL-20070730-1_BlueSkyCat_v2.ocx_ActiveX_remote_heap_overflow_vulnerability_en.txt · Note