PT-2009-2547 · Maxum · Rumpus

Published 2009-08-25 · Updated 2018-10-11 · CVE-2008-7078

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rumpus versions prior to 6.0.1

Description The issue is related to multiple buffer overflows that can be exploited by remote attackers to cause a denial of service, resulting in a segmentation fault, by sending a long HTTP verb in the HTTP component. Additionally, remote authenticated users can execute arbitrary code by providing a long argument to certain commands, including MKD, XMKD, and RMD, in the FTP component.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP component and limiting the length of arguments to the MKD, XMKD, and RMD commands until a patch is applied.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-7078

Affected Products

Rumpus

References · 10

• 🔥 http://securityfocus.com/bid/32560 · Exploit
• 🔥 https://exploit-db.com/exploits/7314 · Exploit
• 🔥 http://securityfocus.com/bid/32558 · Exploit
• http://secunia.com/advisories/32892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-7078 · Security Note
• http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0007.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46988 · Note
• http://securityfocus.com/archive/1/498786/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46987 · Note
• http://maxum.com/Rumpus/News601.html · Note