CVE-2009-0187

2009-02-2616:17:00

CWE-119

[email protected]

web.nvd.nist.gov

112

cve-2009-0187

buffer overflow

orbit downloader

remote code execution

security vulnerability

7.8 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.958 High

EPSS

Percentile

99.4%

JSON

Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execute arbitrary code via a crafted HTTP URL with a long host name, which is not properly handled when constructing a “Connecting” log message.

CPENameOperatorVersion
orbitdownloader:orbit_downloaderorbitdownloader orbit downloadereq2.8.4
orbitdownloader:orbit_downloaderorbitdownloader orbit downloadereq2.8.2
orbitdownloader:orbit_downloaderorbitdownloader orbit downloadereq2.8.3

CPE	Name	Operator	Version
orbitdownloader:orbit_downloader	orbitdownloader orbit downloader	eq	2.8.4
orbitdownloader:orbit_downloader	orbitdownloader orbit downloader	eq	2.8.2
orbitdownloader:orbit_downloader	orbitdownloader orbit downloader	eq	2.8.3