多个BSD平台'strfmon()'函数整数溢出漏洞

BUGTRAQ ID: 28479 CVE ID:CVE-2008-1391 CNCVE ID:CNCVE-20081391 多个BSD平台'strfmon'函数处理存在整数溢出，可能以受影响应用程序上下文执行任意代码。失败的尝试可导致拒绝服务。 问题代码类似如下： include monetary.h ssizet strfmonchar restrict s, sizet maxsize, const char restrict format, ...; - --- 1. /usr/src/lib/libc/stdlib/strfmon.c -整数溢出...

CVE-2008-1391

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to 1 the strfmon function in...

Integer overflow

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to 1 the strfmon function in...

CVE-2008-1391

CVE-2008-1391 is an integer overflow in the GNU C Library (glibc) strfmon width specifier handling that may be triggered by an attacker who can control the format string passed to strfmon (and related to printf in some contexts). The connected Nessus/OpenVAS entries indicate this vulnerability wa...

CVE-2008-1391

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to 1 the strfmon function in...

BSD (Multiple Distributions) - strfmon() Integer Overflow

BSD Multiple Distributions - strfmon Integer Overflow // source: https://www.securityfocus.com/bid/28479/info Multiple BSD platforms are prone to an integer-overflow weakness. An attacker can exploit this issue through other applications such as PHP to execute arbitrary code within the context of...

CVE-2008-1391: Undefined Security Weakness

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to 1 the strfmon function in...

BSD (Multiple Distributions) - 'strfmon()' Integer Overflow

// source: https://www.securityfocus.com/bid/28479/info Multiple BSD platforms are prone to an integer-overflow weakness. An attacker can exploit this issue through other applications such as PHP to execute arbitrary code within the context of the affected application. Failed exploit attempts wil...

Design/Logic Flaw

The ipsec4getulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fastipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the destination machine, a...

CVE-2008-1335

The ipsec4getulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fastipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the destination machine, a...

CVE-2008-1335

The ipsec4getulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fastipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the destination machine, a...

CVE-2008-1335

CVE-2008-1335 affects NetBSD kernel (ipsec4_get_ulp) on 2.0–3.1 and NetBSD-current before 20071028 with fast_ipsec enabled, allowing remote attackers to bypass IPsec policy by sending packets from a source with different endianness than the destination. This is a separate vulnerability from CVE-2...

CVE-2008-1335: Undefined Security Weakness

The ipsec4getulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fastipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the destination machine, a...

Stack overflow

Stack-based buffer overflow in the commandExpandInterpret function in command.c in ppp aka user-ppp, as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "" characters...

CVE-2008-1215

Stack-based buffer overflow in the commandExpandInterpret function in command.c in ppp aka user-ppp, as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "" characters...

CVE-2008-1215

CVE-2008-1215 is a stack-based buffer overflow in the command_Expand_Interpret function of command.c used by ppp (user-ppp) in FreeBSD 6.3/7.0, OpenBSD 4.1/4.2, and NetBSD net/userppp. The overflow can let local users gain privileges via long commands containing ~ characters. CVSS2 metrics indica...

CVE-2008-1215

Stack-based buffer overflow in the commandExpandInterpret function in command.c in ppp aka user-ppp, as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "" characters...

CVE-2008-1215: Undefined Security Weakness

Stack-based buffer overflow in the commandExpandInterpret function in command.c in ppp aka user-ppp, as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "" characters...

Design/Logic Flaw

A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...

CVE-2008-1148

A certain pseudo-random number generator PRNG algorithm that uses ADD with 0 random hops aka "Algorithm A0", as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as 1 DNS transaction IDs or 2 IP fragmentation IDs by observing a...