PT-2010-3673 · Sblim · Sblim-Sfcb

Chris Buccella · Published 2010-06-14 · Updated 2023-02-13 · CVE-2010-2054

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SBLIM SFCB versions 1.3.4 through 1.3.7

Description The issue is related to an integer overflow in the httpAdapter.c component of SBLIM SFCB. This occurs when the configuration sets httpMaxContentLength to a zero value, allowing remote attackers to potentially cause a denial of service or execute arbitrary code by sending a large integer in the Content-Length HTTP header.

Recommendations For SBLIM SFCB versions 1.3.4 through 1.3.7, consider setting a non-zero value for httpMaxContentLength to prevent exploitation. Additionally, as a temporary workaround, restrict access to the httpAdapter component until a patch is available.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-2054

Affected Products

Sblim-Sfcb

References · 6

• http://vupen.com/english/advisories/2010/1312 · Vendor Advisory
• http://secunia.com/advisories/40018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2054 · Security Note
• http://sourceforge.net/tracker/index.php?func=detail&aid=3001915&group_id=128809&atid=712784 · Note
• http://sblim.cvs.sourceforge.net/viewvc/sblim/sfcb/httpAdapter.c?r1=1.85&r2=1.86 · Note
• http://marc.info/?l=bugtraq&m=127549079109192&w=2 · Note