5

CVE-2007-4450

Exploit
The server in Toribash 2.71 and earlier does not properly handle long commands, which allows remote attackers to trigger a protocol violation in which data is sent to other clients without a required LF character, as demonstrated by a SAY command.  NOTE: the security impact of this violation is not clear, although it probably makes exploitation of CVE-2007-4449 easier.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Toribash ≫ Toribash Version <= 2.71
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.53% 0.715
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://aluigi.org/poc/toribashish.zip
Exploit
http://secunia.com/advisories/26507
Vendor Advisory
http://securityreason.com/securityalert/3033
http://www.securityfocus.com/archive/1/477025/100/0/threaded
http://www.securityfocus.com/bid/25359
Exploit