Vulnerability CVE-2007-5405 - CERT Civis.Net

Vulnerability Name:

CVE-2007-5405 (CCN-41721)

Assigned:

2007-10-12

Published:

2008-04-08

Updated:

2018-10-15

Summary:

Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, allow remote attackers to execute arbitrary code via a .ag file with (1) a long ENCODING attribute in a *BEGIN tag, (2) a long token, or (3) the initial *BEGIN tag.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2007-5405

Source: CCN
Type: SA27763
Symantec Mail Security for Exchange Attachment Parsing Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
27763

Source: CCN
Type: SA28140
activePDF DocConverter Multiple Parsing Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
28140

Source: CCN
Type: SA28209
Autonomy Keyview SDK Multiple Buffer Overflows

Source: SECUNIA
Type: Vendor Advisory
28209

Source: CCN
Type: SA28210
Lotus Notes Multiple Keyview Parsing Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
28210

Source: CCN
Type: SA29342
Symantec Mail Security Attachment Parsing Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
29342

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2007-95/advisory/

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2007-96/advisory/

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2007-97/advisory/

Source: CCN
Type: Secunia Research 08/04/2008
Symantec Mail Security Applix Graphics Parsing Vulnerabilities

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2007-98/advisory/

Source: CCN
Type: SECTRACK ID: 1019805
Symantec Mail Security Buffer Overflows in Autonomy KeyView Module Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1019805

Source: CCN
Type: SECTRACK ID: 1019844
IBM Lotus Notes Buffer Overflows in Applix Viewer Lets Remote Users Execute Arbitrary Code

Source: CONFIRM
Type: UNKNOWN
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21298453

Source: CCN
Type: IBM Web site
Lotus Notes

Source: CCN
Type: Autonomy Web site
KeyView IDOL Export SDK

Source: CCN
Type: OSVDB ID: 44194
Autonomy Keyview Multiple Products Applix Graphics Reader (kpagrdr.dll) Multiple Overflows

Source: BUGTRAQ
Type: UNKNOWN
20080414 Secunia Research: Lotus Notes Applix Graphics ParsingVulnerabilities

Source: BUGTRAQ
Type: UNKNOWN
20080414 Secunia Research: Autonomy Keyview Applix Graphics ParsingVulnerabilities

Source: BUGTRAQ
Type: UNKNOWN
20080414 Secunia Research: Symantec Mail Security Applix Graphics ParsingVulnerabilities

Source: BUGTRAQ
Type: UNKNOWN
20080414 Secunia Research: activePDF DocConverter Applix Graphics ParsingVulnerabilities

Source: BID
Type: UNKNOWN
28454

Source: CCN
Type: BID-28454
Autonomy KeyView Module Multiple Buffer Overflow Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1019844

Source: CONFIRM
Type: UNKNOWN
http://www.symantec.com/avcenter/security/Content/2008.04.08e.html

Source: CCN
Type: Symantec Web site
Symantec Mail Security for SMTP

Source: VUPEN
Type: UNKNOWN
ADV-2008-1153

Source: VUPEN
Type: UNKNOWN
ADV-2008-1154

Source: VUPEN
Type: UNKNOWN
ADV-2008-1156

Source: XF
Type: UNKNOWN
autonomy-keyview-applix-multiple-bo(41721)

Source: XF
Type: UNKNOWN
autonomy-keyview-applix-multiple-bo(41721)

Vulnerable Configuration:

Configuration 1:

cpe:/a:activepdf:docconverter:3.8.2_.5:*:*:*:*:*:*:*

OR cpe:/a:activepdf:docconverter:3.8.4.0:*:*:*:*:*:*:*

OR cpe:/a:autonomy:keyview:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:autonomy:keyview:10.3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:6.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:6.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:7.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:7.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:7.0.3:*:*:*:*:*:*:*

OR cpe:/a:symantec:mail_security:5.0:*:microsoft_exchange:*:*:*:*:*

OR cpe:/a:symantec:mail_security:5.0.0:*:smtp:*:*:*:*:*

OR cpe:/a:symantec:mail_security:5.0.1:*:smtp:*:*:*:*:*

OR cpe:/a:symantec:mail_security:7.5:*:domino:*:*:*:*:*

OR cpe:/a:symantec:mail_security_appliance:5.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:autonomy:keyview_export_sdk:10.3:*:*:*:*:*:*:*

OR cpe:/a:autonomy:keyview_filter_sdk:10.3:*:*:*:*:*:*:*

OR cpe:/a:autonomy:keyview_viewer_sdk:10.3:*:*:*:*:*:*:*

OR cpe:/a:autonomy:keyview_viewer_sdk:10:*:*:*:*:*:*:*

OR cpe:/a:autonomy:keyview_filter_sdk:10:*:*:*:*:*:*:*

OR cpe:/a:autonomy:keyview_export_sdk:10:*:*:*:*:*:*:*

AND

cpe:/a:ibm:lotus_notes:8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:lotus_notes:7.0.3:*:*:*:*:*:*:*

OR cpe:/a:activepdf:docconverter:3.8.4.0:*:*:*:*:*:*:*

Denotes that component is vulnerable