Vulnerability CVE-2007-1503

Vulnerability CVE-2007-1503

Published: 2007-03-19 Modified: 2012-02-12

Description:

Multiple format string vulnerabilities in comm.c in Rhapsody IRC 0.28b allow remote attackers to execute arbitrary code via format string specifiers to the create_ctcp_message function using the message argument to the (1) me or (2) ctcp commands, and possibly related vectors involving the (3) whois, (4) mode, and (5) topic commands.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Rhapsody IRC 0.28b (NICK) Multiple fs and bof vulnerability	starcadi	21.03.2007

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Rhapsody irc -> Rhapsody irc

References:

http://securityreason.com/securityalert/2447

http://www.securityfocus.com/archive/1/463092/100/0/threaded

http://www.securityfocus.com/bid/23011

Copyright 2024, cxsecurity.com