PT-2007-6348 · Unknown · Dawn Of Time

Published 2007-10-08 · Updated 2018-10-15 · CVE-2007-5265

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Dawn of Time versions 1.69s beta4 and earlier

Description: The issue allows remote attackers to execute arbitrary code via format string specifiers in the username or password fields when accessing certain restricted zones. The processWebHeader and filterWebRequest functions do not properly handle these fields.

Recommendations: For Dawn of Time versions 1.69s beta4 and earlier, as a temporary workaround, consider restricting access to the restricted zones until a patch is available. Avoid using format string specifiers in the username and password fields. Restrict the use of the processWebHeader and filterWebRequest functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2007-5265

Affected Products

Dawn Of Time

References · 10

• 🔥 https://exploit-db.com/exploits/30644 · Exploit
• 🔥 http://aluigi.altervista.org/adv/dawnfs-adv.txt · Exploit
• 🔥 http://securityfocus.com/bid/25944 · Exploit
• http://secunia.com/advisories/27083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5265 · Security Note
• http://securityfocus.com/archive/1/481619/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36973 · Note
• http://vupen.com/english/advisories/2007/3418 · Note
• http://securityreason.com/securityalert/3201 · Note
• http://forums.dawnoftime.org/viewtopic.php?t=2102 · Note