EIP-db4e064b
A stack-based buffer overflow vulnerability exists within Xerox DocuShare. Exploitation of the vulnerability allows for attackers to execute arbitrary code with system privileges. The specific flaw exists within the parsing of AMI Pro (.sam) file formats. Parsing of this file structure is handled by the KeyView subsystem (lasr.dll).
Vulnerability Identifiers
Exodus Intelligence: EIP-db4e064b
MITRE CVE: CVE-2007-5909
Vulnerability Metrics
CVSSv2 Score: 6.8
Vendor References
https://securitydocs.business.xerox.com/wp-content/uploads/2022/02/DocuShare-Security-Bulletin-Regarding-CVE-2007-5909-and-CVE-2007-5910.pdf
Discovery Credit
Exodus Intelligence
Disclosure Timeline
Disclosed to affected vendor: December 10th, 2021
Disclosed to public: February 24th, 2022
Further Information
Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].
Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.
The post Xerox DocuShare AMI Pro File Parsing Stack Overflow Vulnerability appeared first on Exodus Intelligence.
Support the originator by clicking the read the rest link below.
