PT-2007-6029 · Boa · Boa

Ikki + 1 · Published 2007-09-17 · Updated 2018-10-15 · CVE-2007-4915

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Boa version 0.93.15

Description: The issue allows remote attackers to change the admin password stored in memory by sending a long username in an HTTP Basic Authentication request. This is due to the failure of the Intersil isl3893 extensions to prevent stack writes from entering memory locations used for string constants.

Recommendations: For Boa version 0.93.15, consider restricting access to the HTTP Basic Authentication endpoint until a fix is available. As a temporary workaround, avoid using the username variable in the affected API endpoint, such as "/api/v1/login", to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-4915

Affected Products

Boa

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/intersil_pass_reset.rb · Exploit
• 🔥 https://exploit-db.com/exploits/30584 · Exploit
• 🔥 https://exploit-db.com/exploits/4542 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4915 · Security Note
• http://gnucitizen.org/projects/router-hacking-challenge · Note
• http://securityfocus.com/archive/1/489009/100/0/threaded · Note
• http://securenetwork.it/ricerca/advisory/download/SN-2007-02.txt · Note
• http://securityreason.com/securityalert/3151 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4915 · Note
• http://ikkisoft.com/stuff/SN-2007-02.txt · Note
• http://securityfocus.com/bid/25676 · Note
• http://securityfocus.com/archive/1/479434/100/0/threaded · Note