CVE-2008-0767 ExtremeZ-IP.exe in ExtremeZ-IP File and Print Server 5.1.2x15 and earlier does not verify that a certain "number of URLs" field is consistent with the packet length, which allows remote attackers to c...
MediumCVSS 5.0
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ExtremeZ-IP.exe in ExtremeZ-IP File and Print Server 5.1.2x15 and earlier does not verify that a certain "number of URLs" field is consistent with the packet length, which allows remote attackers to cause a denial of service (daemon crash) via a large integer in this field in a packet to the Service Location Protocol (SLP) service on UDP port 427, triggering an out-of-bounds read.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| extremez print server | <= 5.1.2 | No fix listed |
| extremez-ip file server | <= 5.1.2 | No fix listed |
References
- aluigi.altervista.org
- aluigi.org
- 28862 third-party-advisory vendor-advisory
- www.grouplogic.com
- 20080211 Multiple vulnerabilities in EztremeZ-IP File and Printer Server 5.1.2x15 mailing-list
- 27718 vdb-entry
- ADV-2008-0485 vdb-entry