CVE-2007-4915 Memory corruption in n/a
Remote attackers can overwrite admin passwords in memory via stack corruption in Boa web server, leading to unauthorized administrative access on affected wireless access points.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-4915?
CVE-2007-4915 is a critical memory corruption vulnerability in n/a, published on 17 Sep 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent stack writes from entering memory locations used for string constants, which allows remote attackers to change the admin password stored in memory via a long username in an HTTP Basic Authentication request.
Weakness: CWE-20
Which versions are affected by CVE-2007-4915?
It affects 1 product.
Products include Boa Boa Webserver.
How do I fix CVE-2007-4915?
No fix has been published for CVE-2007-4915 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2007-4915 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-4915 exists.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Other vulnerabilities in n/a
Sources
Also known as GHSA-qww2-669w-5rff.