CVE-2007-1666 Missing authorization in n/a
Remote attackers can bypass authentication in the IDA Pro debugger server to perform unauthorized actions, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-1666?
CVE-2007-1666 is a critical missing authorization vulnerability in n/a, published on 24 Mar 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The processor_request function in the debugger server for DataRescue IDA Pro 5.0 and 5.1 does not verify that authentication has taken place before invoking the perform_request function, which allows remote attackers to perform unauthorized actions.
Weakness: CWE-20
Which versions are affected by CVE-2007-1666?
It affects 1 product.
Products include Datarescue Ida Pro.
How do I fix CVE-2007-1666?
No fix has been published for CVE-2007-1666 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2007-1666 being exploited?
There is no known exploitation of CVE-2007-1666 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-77g5-35h8-qf58.