CVE-2007-4074
First published: Mon Jul 30 2007(Updated: )
The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956. NOTE: this issue is local in some environments, but remote on others.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Centre For Speech Technology Research Gentoo Linux | =festival_1.95_beta | |
| SUSE Linux |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.gentoo.org/show_bug.cgi?id=170477
- http://security.gentoo.org/glsa/glsa-200707-10.xml
- http://www.securityfocus.com/bid/25069
- http://secunia.com/advisories/26229
- http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html
- http://secunia.com/advisories/27271
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35606
- http://www.securityfocus.com/archive/1/490465/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-4074?
CVE-2007-4074 is considered to have a medium severity due to the potential for local and remote attackers to execute arbitrary code.
How do I fix CVE-2007-4074?
To fix CVE-2007-4074, update the CSTR Festival package to a version that is not affected by the vulnerability.
What versions are affected by CVE-2007-4074?
CVE-2007-4074 affects the default configuration of CSTR Festival 1.95 beta on Gentoo Linux, SUSE Linux, and possibly other distributions.
Can CVE-2007-4074 be exploited remotely?
Yes, CVE-2007-4074 can be exploited remotely if the vulnerable configuration is accessible.
What are the potential impacts of CVE-2007-4074?
The impact of CVE-2007-4074 includes unauthorized execution of arbitrary code, potentially compromising the system's integrity.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/centre for speech technology research
- canonical/centre for speech technology research gentoo linux
- version/centre for speech technology research gentoo linux/festival_1.95_beta
- vendor/suse
- canonical/suse linux