National Cyber-Alert System
Vulnerability Summary for CVE-2007-5405
Original release date:04/10/2008
Last revised:09/05/2008
Source:
US-CERT/NIST
Overview
Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, allow remote attackers to execute arbitrary code via a .ag file with (1) a long ENCODING attribute in a *BEGIN tag, (2) a long token, or (3) the initial *BEGIN tag.
Impact
CVSS Severity (version 2.0):
Impact Subscore:
10.0
Exploitability Subscore:
8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type:Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.
External Source: XF
Name: autonomy-keyview-applix-multiple-bo(41721)
External Source: CONFIRM
Name: http://www.symantec.com/avcenter/security/Content/2008.04.08e.html
External Source: SECTRACK
Name: 1019844
External Source: BID
Name: 28454
External Source: BUGTRAQ
Name: 20080414 Secunia Research: activePDF DocConverter Applix Graphics ParsingVulnerabilities
External Source: BUGTRAQ
Name: 20080414 Secunia Research: Symantec Mail Security Applix Graphics ParsingVulnerabilities
External Source: BUGTRAQ
Name: 20080414 Secunia Research: Autonomy Keyview Applix Graphics ParsingVulnerabilities
External Source: BUGTRAQ
Name: 20080414 Secunia Research: Lotus Notes Applix Graphics ParsingVulnerabilities
External Source: VUPEN
Name: ADV-2008-1156
Type: Advisory
External Source: VUPEN
Name: ADV-2008-1154
Type: Advisory
External Source: VUPEN
Name: ADV-2008-1153
Type: Advisory
External Source: CONFIRM
Name: http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21298453
External Source: SECTRACK
Name: 1019805
External Source: MISC
Name: http://secunia.com/secunia_research/2007-98/advisory/
Type: Advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2007-97/advisory/
Type: Advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2007-96/advisory/
Type: Advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2007-95/advisory/
Type: Advisory
External Source: SECUNIA
Name: 29342
Type: Advisory
External Source: SECUNIA
Name: 28210
Type: Advisory
External Source: SECUNIA
Name: 28209
Type: Advisory
External Source: SECUNIA
Name: 28140
Type: Advisory
External Source: SECUNIA
Name: 27763
Type: Advisory
