CVE-2007-4358 Denial of service in n/a
Remote attackers can crash the Zoidcom server by sending a malformed JOIN packet, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-4358?
CVE-2007-4358 is a medium-severity denial of service vulnerability in n/a, published on 15 Aug 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zoidcom 0.6.7 and earlier allows remote attackers to cause a denial of service (application crash) via a JOIN packet (aka connection packet) containing 0x69 in the ninth byte, which triggers a "double-delete" of trace data, a different vulnerability than CVE-2005-1643.
Which versions are affected by CVE-2007-4358?
It affects 1 product.
Products include Zoidcom Zoidcom.
How do I fix CVE-2007-4358?
No fix has been published for CVE-2007-4358 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2007-4358 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-4358 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-7q45-837r-mmf6.