CVE-2007-3911

Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.

Score

CVSS 2.0 10.0 Critical

Status

Modified - cve@mitre.org

Published

2007-07-30

Last modified

2024-08-07

Weaknesses

CWE-119

Affected products

• Netvault Reporter (Bakbone)

References

• http://secunia.com/advisories/26222
• http://securityreason.com/securityalert/2954
• http://www.securityfocus.com/archive/1/474626/100/0/threaded
• http://www.securityfocus.com/bid/25068
• http://www.securitytracker.com/id?1018460
• http://www.vupen.com/english/advisories/2007/2658
• http://www.zerodayinitiative.com/advisories/ZDI-07-044.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35588