« Volver al listado

CVE-2007-1344

Estado: ModificadaAlta (9.3)—

Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to execute arbitrary code via a crafted XML configuration file processed by the (1) urlParse function, which causes a stack-based overflow and the (2) ReplaceString function, which causes a heap-based overflow. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Xiph — Icecast Ezstream

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-1344",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-03-08T22:19:00.000",
  "references": [
    {
      "url": "http://osvdb.org/33869",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/24383",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.icecast.org/ezstream.php#ez_relnotes",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/22840",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/0852",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32867",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/33869",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24383",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.icecast.org/ezstream.php#ez_relnotes",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/22840",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/0852",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32867",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in src/ezstream.c in Ezstream before 0.3.0 allow remote attackers to execute arbitrary code via a crafted XML configuration file processed by the (1) urlParse function, which causes a stack-based overflow and the (2) ReplaceString function, which causes a heap-based overflow.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples desbordamientos de búfer en el src/ezstream.c del Ezstream before 0.3.0 permiten a atacantes remotos ejecutar código de su elección mediante la manipulación del fichero de configuración XML procesado por (1) la función urlParse, lo que provoca desbordamientos basados en pila y (2) la función ReplaceString, lo que provoca desbordamientos basados en montón. NOTA: algunos de los detalles se obtienen a partir de la información de terceros."
    }
  ],
  "lastModified": "2026-06-16T22:37:23.240",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xiph:icecast_ezstream:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B610408B-BB3D-4700-9FE2-597749E53F48",
              "versionEndIncluding": "0.1.0"
            },
            {
              "criteria": "cpe:2.3:a:xiph:icecast_ezstream:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1F8694A-51BA-4B01-B0AA-AF90A5B4F2BC",
              "versionEndIncluding": "0.1.1"
            },
            {
              "criteria": "cpe:2.3:a:xiph:icecast_ezstream:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "054B3203-9AF0-4CDD-8EC0-F427C0084BBE",
              "versionEndIncluding": "0.1.2"
            },
            {
              "criteria": "cpe:2.3:a:xiph:icecast_ezstream:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EE57171-F3CB-4AAE-BCBB-D066A09421DA",
              "versionEndIncluding": "0.1.3"
            },
            {
              "criteria": "cpe:2.3:a:xiph:icecast_ezstream:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B72E48A-C7B1-4ABE-A816-AC608CF92CE0",
              "versionEndIncluding": "0.2.0"
            },
            {
              "criteria": "cpe:2.3:a:xiph:icecast_ezstream:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D2D745C-33E5-42CB-B188-293AF99B928A",
              "versionEndIncluding": "0.2.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "This vulnerability has been addressed through a product update:\r\nhttp://www.icecast.org/ezstream.php#ez_download",
  "sourceIdentifier": "cve@mitre.org"
}