PT-2007-5469 · Esri · Esri Arcsde

Published 2007-08-15 · Updated 2024-07-11 · CVE-2007-4278

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ESRI ArcSDE service version 9.2

Description The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number that requires more than 8 bytes to represent in ASCII. This triggers the overflow in an sprintf function call.

Recommendations For ESRI ArcSDE service version 9.2, consider restricting access to the giomgr process to minimize the risk of exploitation until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2007-4278

Affected Products

Esri Arcsde

References · 9

• http://downloads.esri.com/support/downloads/other_/ArcSDE-92sp3-issues.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4278 · Security Note
• https://t.me/cvenotify/85923 · Telegram Post
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=577 · Note
• http://secunia.com/advisories/26452 · Note
• http://securityfocus.com/bid/25334 · Note
• http://securitytracker.com/id?1018574 · Note
• http://vupen.com/english/advisories/2007/2911 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36042 · Note