ID

VAR-200908-0054

CVE

CVE-2008-7078

TITLE

Rumpus Vulnerable to buffer overflow

DESCRIPTION

Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation fault) via a long HTTP verb in the HTTP component; and allow remote authenticated users to execute arbitrary code via a long argument to the (2) MKD, (3) XMKD, (4) RMD, and other unspecified commands in the FTP component. Maxum Rumpus FTP Server is prone to a remote denial-of-service vulnerability. This issue allows remote attackers to crash affected servers, denying service to legitimate users. Maxum Rumpus is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application, possibly with root privileges. Failed exploit attempts will result in a denial-of-service condition. Versions prior to Rumpus 6.0.1 are vulnerable. ---------------------------------------------------------------------- Did you know that a change in our assessment rating, exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more: http://secunia.com/advisories/business_solutions/ ---------------------------------------------------------------------- TITLE: Rumpus Multiple Vulnerabilities SECUNIA ADVISORY ID: SA32892 VERIFY ADVISORY: http://secunia.com/advisories/32892/ CRITICAL: Moderately critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Rumpus 6.x http://secunia.com/advisories/product/20643/ DESCRIPTION: Blue Moon Consulting has reported some vulnerabilities in Rumpus, which can be exploited by malicious people to cause a DoS (Denial of Service) and by malicious users to potentially compromise a vulnerable system. 1) An error in the HTTP service when processing overly long HTTP methods can be exploited to cause a crash. 2) A boundary error in the FTP service when processing arguments sent to the e.g. "MKD", "XMKD", "RMD" FTP commands can be exploited to cause a stack-based buffer overflow. Successful exploitation of this vulnerability may allow execution of arbitrary code, but requires valid FTP credentials. The vulnerabilities are reported in version 6.0. SOLUTION: Update to version 6.0.1. PROVIDED AND/OR DISCOVERED BY: Blue Moon Consulting ORIGINAL ADVISORY: Blue Moon Consulting (BMSA 2008-09): http://lists.grok.org.uk/pipermail/full-disclosure/2008-December/066086.html Maxum: http://www.maxum.com/Rumpus/News601.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

network

TYPE

Boundary Condition Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Blue Moon Consulting

SOURCES

LAST UPDATE DATE

2025-04-10T23:17:53.363000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE