CVE-2007-3911

BakBone NetVault Reporter < 3.5update3 - Remote Code Execution via Long Filename Argument

Title source: llm

Description

Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests.

References (8)

Core 8

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1018460

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26222

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/474626/100/0/threaded

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/2658

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/35588

Third Party Advisory x_refsource_misc

http://www.zerodayinitiative.com/advisories/ZDI-07-044.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/25068

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/2954

Scores

EPSS 0.0683

EPSS Percentile 93.3%

Details

CWE

CWE-119

Status published

Products (1)

bakbone/netvault_reporter < 3.5update3

Published Jul 30, 2007

Tracked Since Feb 18, 2026