PT-2008-1590 · Lscube · Lscube Feng

Luigi Auriemma · Published 2008-01-04 · Updated 2018-10-15 · CVE-2007-6627

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LScube Feng versions 0.1.15 and earlier

Description The issue is related to an integer overflow in the RTSP remove msg function, which can be triggered by a remote attacker sending an RTP packet with a size value of 0xffff. This can cause a denial of service (crash) and potentially allow the execution of arbitrary code.

Recommendations For versions 0.1.15 and earlier, consider disabling the RTSP remove msg function as a temporary workaround until a patch is available. Restrict access to the RTP packet handling module to minimize the risk of exploitation. Avoid using size values that could trigger the integer overflow in the affected function.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2007-6627

Affected Products

Lscube Feng

References · 9

• 🔥 http://securityfocus.com/bid/27049 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6627 · Security Note
• http://securityreason.com/securityalert/3507 · Note
• http://securityfocus.com/archive/1/485574/100/0/threaded · Note
• http://vupen.com/english/advisories/2008/0011 · Note
• http://aluigi.altervista.org/adv/fengulo-adv.txt · Note
• http://aluigi.org/poc/fengulo.zip · Note
• http://secunia.com/advisories/28229 · Note
• http://osvdb.org/40533 · Note