PT-2007-5347 · Visionsoft · Visionsoft Audit

Published 2007-08-03 · Updated 2008-11-15 · CVE-2007-4151

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visionsoft Audit version 12.4.0.0

Description The issue allows remote attackers to obtain sensitive information. This can be achieved through three methods: (1) a LOG.ON command, which reveals the logging pathname in the server response, (2) a VER command, which reveals the version number in the server response, and (3) a connection, which reveals the version number in the banner.

Recommendations For Visionsoft Audit version 12.4.0.0, consider restricting access to the LOG.ON and VER commands to minimize the risk of exploitation. Additionally, restrict access to the connection banner to prevent version number disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-4151

Affected Products

Visionsoft Audit

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-4151 · Security Note
• http://portcullis.co.uk/uplds/advisories/vapathdisclosure%2006-043.txt · Note
• http://securityfocus.com/bid/25153 · Note
• http://osvdb.org/46982 · Note
• http://osvdb.org/46981 · Note
• http://osvdb.org/46983 · Note
• http://portcullis.co.uk/uplds/advisories/vaversiondisclosure%2006_046.txt · Note