CVE-2007-3911 Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attacke...
HighCVSS 10.0
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bakbone netvault reporter | <= 3.5update3 | No fix listed |
References
- 26222 patch third-party-advisory vendor-advisory
- 2954 third-party-advisory
- 20070725 ZDI-07-044: BakBone NetVault Reporter Scheduler Heap Overflow Vulnerability mailing-list
- 25068 vdb-entry
- 1018460 vdb-entry
- ADV-2007-2658 vdb-entry
- www.zerodayinitiative.com
- netvaultreport-scheduler-bo(35588) vdb-entry