CVE-2007-1669

zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, (2) Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and (3) AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/23823	Exploit
http://secunia.com/advisories/25122	Patch Vendor Advisory
http://www.amavis.org/security/asa-2007-2.txt
http://www.attrition.org/pipermail/vim/2007-July/001725.html
http://www.osvdb.org/35795
http://secunia.com/advisories/25315	Vendor Advisory
http://securityreason.com/securityalert/2680
http://www.vupen.com/english/advisories/2007/1699
https://exchange.xforce.ibmcloud.com/vulnerabilities/34080
http://www.securityfocus.com/archive/1/467646/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.01.001:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.03.053:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.1.18:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.0.54:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.1.17:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.4:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.03.055:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.15.026:::::::*
	cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.3:::::::*

cpe:2.3:a:amavis:amavis:*:*:*:*:*:*:*:*

Information

Published : 2007-05-08 17:19

Updated : 2018-10-16 09:40

NVD link : CVE-2007-1669

Mitre link : CVE-2007-1669

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

amavis

amavis

barracuda_networks

barracuda_spam_firewall

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/23823", "name": "23823", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/25122", "name": "25122", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.amavis.org/security/asa-2007-2.txt", "name": "http://www.amavis.org/security/asa-2007-2.txt", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.attrition.org/pipermail/vim/2007-July/001725.html", "name": "20070724 zoo - amavis - barracuda cross-ref problems", "tags": [], "refsource": "VIM"}, {"url": "http://www.osvdb.org/35795", "name": "35795", "tags": [], "refsource": "OSVDB"}, {"url": "http://secunia.com/advisories/25315", "name": "25315", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/2680", "name": "2680", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2007/1699", "name": "ADV-2007-1699", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34080", "name": "multiple-vendor-zoo-dos(34080)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/467646/100/0/threaded", "name": "20070504 Multiple vendors ZOO file decompression infinite loop DoS", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, (2) Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and (3) AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-1669", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-05-09T00:19Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.01.001:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.03.053:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.1.18:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.0.54:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.1.17:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.03.055:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.15.026:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:h:barracuda_networks:barracuda_spam_firewall:3.3.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:amavis:amavis:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.4.1"}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-16T16:40Z"}