PT-2007-5940 · Transperfect · Globallink

Void · Published 2007-09-11 · Updated 2017-09-29 · CVE-2007-4802

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: GlobalLink version 2.7.0.8

Description: The issue is related to multiple heap-based buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved through a long eighth argument to the SetInfo method in a certain ActiveX control in glItemCom.dll or a long second argument to the SetClientInfo method in a certain ActiveX control in glitemflat.dll.

Recommendations: For GlobalLink version 2.7.0.8, consider disabling the SetInfo and SetClientInfo methods in the affected ActiveX controls until a patch is available. Restrict access to the glItemCom.dll and glitemflat.dll modules to minimize the risk of exploitation. Avoid using long arguments in the SetInfo and SetClientInfo methods until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-4802

Affected Products

Globallink

References · 9

• 🔥 http://securityfocus.com/bid/25565 · Exploit
• 🔥 https://exploit-db.com/exploits/4366 · Exploit
• 🔥 https://exploit-db.com/exploits/4372 · Exploit
• 🔥 http://securityfocus.com/bid/25586 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4802 · Security Note
• http://osvdb.org/45887 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36470 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36501 · Note
• http://osvdb.org/45886 · Note