Vulnerability CVE-2007-3911
Published: 2007-07-30   Modified: 2012-02-12

Description:
Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.

See advisories in our WLB2 database:
Topic
Author
Date
High
BakBone NetVault Reporter Scheduler Heap Overflow Vulnerability
ZDI
02.08.2007

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Bakbone -> Netvault reporter 

 References:
http://securityreason.com/securityalert/2954
http://www.securityfocus.com/archive/1/474626/100/0/threaded
http://www.securityfocus.com/bid/25068
http://www.securitytracker.com/id?1018460
http://www.vupen.com/english/advisories/2007/2658
http://www.zerodayinitiative.com/advisories/ZDI-07-044.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/35588
Copyright 2024, cxsecurity.com

 

Back to Top