PT-2008-2928 · Motum · Timbuktu Pro

Published 2008-03-14 · Updated 2018-10-11 · CVE-2008-1337

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Timbuktu Pro versions 8.6.5 RC 229 and earlier

Description The issue affects the instant message service, allowing remote attackers to cause a denial of service. This can happen in two ways: (1) by sending an invalid Version field, which can cause the daemon to crash, or (2) by sending an invalid or partial message, leading to CPU consumption and eventual daemon termination.

Recommendations For Timbuktu Pro versions 8.6.5 RC 229 and earlier, consider disabling the instant message service until a fix is available to prevent potential denial of service attacks.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1337

Affected Products

Timbuktu Pro

References · 7

• 🔥 http://aluigi.org/poc/timbuto.zip · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1337 · Security Note
• http://secunia.com/advisories/29316 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0840 · Note
• http://securityreason.com/securityalert/3741 · Note
• http://aluigi.altervista.org/adv/timbuto-adv.txt · Note
• http://securityfocus.com/archive/1/489360/100/0/threaded · Note