Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

NewsReactor may run attacker code via long yEnc filenames

CVE-2007-1568 · published 19 years ago
Summary

NewsReactor can be tricked by a specially crafted yEnc file (a type of encoded attachment) that has an unusually long name. This mistake allows a remote hacker to run their own programs on the server, potentially taking control. Apply the latest software update or stop using the product until a fix is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
daansystems newsreactor 2007-02-21
cpe:2.3:a:daansystems:newsreactor:2007-02-21:*:*:*:*:*:*:*
Original advisory text
Stack-based buffer overflow in DaanSystems NewsReactor 20070220.21 allows remote attackers to execute arbitrary code via a yEnc (yEncode) encoded article with a long filename.
Stack-based buffer overflow in DaanSystems NewsReactor 20070220.21 allows remote attackers to execute arbitrary code via a yEnc (yEncode) encoded article with a long filename.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
8% chance of attack within 30 days
Timeline
Published21 Mar 2007
Updated25 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-1568 · NVD
Track software like this
Free during beta