PT-2007-6632 · 3Proxy · 3Proxy

Published 2007-10-29 · Updated 2018-10-15 · CVE-2007-5622

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions 3proxy versions 0.5 through 0.5.3i

Description A double free issue in the ftpprchild function in ftppr allows remote attackers to cause a denial of service, resulting in a daemon crash. This can be achieved by sending multiple OPEN commands to the FTP proxy.

Recommendations For versions 0.5 through 0.5.3i, consider restricting access to the FTP proxy to minimize the risk of exploitation until a patch is available. As a temporary workaround, limiting the number of OPEN commands to the FTP proxy may help mitigate the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2007-5622

Affected Products

3Proxy

References · 11

• http://security.gentoo.org/glsa/glsa-200711-13.xml · Vendor Advisory
• http://secunia.com/advisories/27607 · Vendor Advisory
• http://secunia.com/advisories/27353 · Vendor Advisory
• http://securityfocus.com/bid/26180 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-5622 · Security Note
• http://3proxy.ru/0.5.3j/Changelog.txt · Patch
• http://securityfocus.com/archive/1/482697/100/0/threaded · Note
• http://bugs.gentoo.org/show_bug.cgi?id=196772 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066985.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37401 · Note
• http://osvdb.org/41870 · Note