National Cyber Awareness System

Vulnerability Summary for CVE-2007-2352

Overview

Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls, possibly involving (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d) tools/afinfo.cpp, (e) aimage/imager.cpp, and (f) tools/afxml.cpp. NOTE: this identifier is intended to address the vectors that were not fixed in CVE-2007-2054, but the unfixed vectors were not explicitly listed.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

The vendor has addressed this issue with the following product update: http://www.afflib.org/downloads/ }

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt

Type: Patch Information

Hyperlink:http://www.vsecurity.com/bulletins/advisories/2007/afflib-fmtstr.txt

External Source: BUGTRAQ

Name: 20070427 AFFLIB(TM): Multiple Format String Injections

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/467040/100/0/threaded

External Source: SREASON

Name: 2657

Hyperlink:http://securityreason.com/securityalert/2657