CVE-2007-2055: Undefined Security Weakness

AFFLIB 2.2.8 and earlier allows attackers to execute arbitrary commands via shell metacharacters involving 1 certain command line parameters in tools/afconvert.cpp and 2 arguments to the getparameter function in aimage/ident.cpp. NOTE: it is unknown if the getparameter vector 2 is ever called...

CVE-2007-2352: Undefined Security Weakness

Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in 1 warn and 2 err calls, possibly involving a lib/s3.cpp, b tools/afconvert.cpp, c tools/afcopy.cpp, d tools/afinfo.cpp, e aimage/imager.cp...

CVE-2007-2054: Undefined Security Weakness

Multiple format string vulnerabilities in AFFLIB before 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in 1 warn and 2 err calls in a lib/s3.cpp, b tools/afconvert.cpp, c tools/afcopy.cpp, d tools/afinfo.cpp, e aimage/aimage.cpp, f...

CVE-2007-2053: Undefined Security Weakness

Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service crash or possibly execute arbitrary code via 1 a long LastModified value in an S3 XML response in lib/s3.cpp; 2 a long a path or b bucket in an S3 URL in lib/vnodes3.cpp; or 3 a long c...

AFFLIB多个格式串处理漏洞

AFFLIB是用于操作高级取证格式（AFF）文件的开源函数库。 AFFLIB的一些命令行工具实现上存在格式串处理漏洞，本地攻击者可能利用此漏洞提升自己的权限。 这些工具以格式串参数向warn和err调用传输一些命令行参数。如果攻击者能够影响这些命令行参数的话，就可能导致执行任意指令。 s3格式串注入 文件：lib/s3.cpp 行数：207 err调用中的一个命令行参数用作了格式串，如果攻击者能够影响名称的话就可以导致格式串注入漏洞。192-207行说明了这个问题： void s3cpconst char fname,string key struct s3headers meta2 =...

AFFLIB(TM): Multiple Format String Injections

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Multiple Format String Injections in AFFLIB Release Date: 2007-04-27 Application...

AFFLIB(TM): Time-of-Check-Time-of-Use File Race

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Time-of-Check-Time-of-Use File Race in AFFLIB Release Date: 2007-04-27...

AFFLIB(TM): Multiple Buffer Overflows

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Multiple Buffer Overflows Discovered in AFFLIB Release Date: 2007-04-27...

AFFLIB library multiple security vulnerabilities

Shell characters injections, buffer overflows, format string vulnerabilities, race conditions, etc...

AFFLIB(TM): Multiple Shell Metacharacter Injections

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Multiple Shell Metacharacter Injections in AFFLIB Release Date: 2007-04-27...