Vulnerability CVE-2007-5775

Vulnerability Name:

CVE-2007-5775 (CCN-38351)

Assigned:

2007-10-24

Published:

2007-10-24

Updated:

2008-09-05

Summary:

Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024.
Note: as of 20071029, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-noinfo

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: BugTraq Mailing List, Tue Nov 20 2007 - 12:24:18 CST
EEYE: BitDefender Online Scanner 8 Double Decode Heap Overflow

Source: MITRE
Type: CNA
CVE-2007-5775

Source: MITRE
Type: CNA
CVE-2007-6189

Source: CCN
Type: eEye Digital Security Advisory AD20071120
BitDefender Online Scanner 8 Double Decode Heap Overflow

Source: CCN
Type: EEYEB-20071024
A vulnerability exists within BitDefender that allows an attacker to execute arbitrary code

Source: MISC
Type: UNKNOWN
http://research.eeye.com/html/advisories/upcoming/20071024.html

Source: CCN
Type: SA27717
BitDefender Online Scanner ActiveX Control Buffer Overflow

Source: CCN
Type: SECTRACK ID: 1018986
BitDefender Heap Overflow in 'Oscan' ActiveX Control Lets Remote Users Execute Arbitrary Code

Source: CCN
Type: BitDefender Web site
BitDefender Free Online VIrus Scan

Source: CCN
Type: OSVDB ID: 40862
BitDefender Online Anti-Virus Scanner ActiveX OScan8.ocx / OScan8.ocx InitX Method Arbitrary Code Execution

Source: BID
Type: UNKNOWN
26210

Source: CCN
Type: BID-26210
BitDefender Online Scanner OScan.OCX ActiveX Control Heap Buffer Overflow Vulnerability

Source: XF
Type: UNKNOWN
bitdefender-oscan-bo(38351)

Vulnerable Configuration:

Configuration 1:

cpe:/a:bitdefender:antivirus:*:*:*:*:*:*:*:*

OR cpe:/a:bitdefender:internet_security:*:*:*:*:*:*:*:*

OR cpe:/a:bitdefender:total_security:*:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK