Guidance Software EnCase does not properly handle (1) certain malformed...
Vulnerability Description
Guidance Software EnCase does not properly handle (1) certain malformed MBR partition tables with many entries, which allows remote attackers to prevent logical collection of a disk image; (2) NTFS filesystems with directory loops, which allows remote attackers to prevent examination of certain directory contents; and (3) certain other malformed NTFS filesystems, which allows remote attackers to prevent examination of corrupted records. NOTE: the vendor disputes the significance of these issues, because physical collection can be used instead, because the vendor believes that relevant attackers typically do not corrupt an MBR or a filesystem, and because detection of a loop is valuable on its own
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-4035
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/archive/1/474809/100/0/threaded
- http://www.blackhat.com/html/bh-usa-07/bh-usa-07-speakers.html#Palmer
- http://www.securityfocus.com/archive/1/474727/100/0/threaded
- http://www.securityfocus.com/archive/1/475335/100/0/threaded
- http://www.securityfocus.com/archive/1/474750/100/0/threaded
- http://www.securityfocus.com/bid/25100
- http://www.isecpartners.com/files/iSEC-Breaking_Forensics_Software-Paper.v1_1.BH2007.pdf
More from guidance software
View All →Affected Vendor
guidance software
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.