PT-2008-2714 · Netopia · Timbuktu Pro

Sebastian Muiz · Published 2008-03-14 · Updated 2018-10-11 · CVE-2008-1118

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Timbuktu Pro versions 8.6.5 for Windows, and possibly 8.7 for Mac OS X

Description The issue allows remote attackers to generate crafted log entries by modifying certain fields, including computer name, user name, and IP address, potentially avoiding detection of attacks. This is due to the lack of input validation before logging information fields taken from packets from a remote peer.

Recommendations For Timbuktu Pro version 8.6.5 on Windows, consider implementing input validation for log information fields to prevent crafted log entries. For Timbuktu Pro version 8.7 on Mac OS X, if affected, apply the same input validation measures as for the Windows version to mitigate the risk.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1118

Affected Products

Timbuktu Pro

References · 8

• 🔥 https://exploit-db.com/exploits/5238 · Exploit
• 🔥 http://securityfocus.com/bid/28081 · Exploit
• http://secunia.com/advisories/29316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1118 · Security Note
• http://securityreason.com/securityalert/3742 · Note
• http://coresecurity.com/?action=item&id=2166 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41330 · Note
• http://securityfocus.com/archive/1/489414/100/0/threaded · Note