Published: 27/03/2008 Updated: 11/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent malicious users to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freebsd freebsd 6.0
netbsd netbsd 4.0
freebsd freebsd 6.0_p5_release
freebsd freebsd 7.0
freebsd freebsd 7.0_beta4
freebsd freebsd 7.0_releng

The GNU C library did not correctly handle certain mnt entries, strfmon arguments, and ELF program headers ...

source: wwwsecurityfocuscom/bid/28479/info Multiple BSD platforms are prone to an integer-overflow weakness An attacker can exploit this issue through other applications such as PHP to execute arbitrary code within the context of the affected application Failed exploit attempts will result in a denial-of-service condition This issue ...

CWE-189 http://securityreason.com/achievement_securityalert/53 http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c http://securityreason.com/securityalert/3770 http://www.securitytracker.com/id?1019722 http://secunia.com/advisories/29574 http://www.securityfocus.com/bid/28479 http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://secunia.com/advisories/33179 http://www.us-cert.gov/cas/techalerts/TA08-350A.html http://support.apple.com/kb/HT3338 http://www.debian.org/security/2010/dsa-2058 http://www.vupen.com/english/advisories/2008/3444 https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html https://exchange.xforce.ibmcloud.com/vulnerabilities/41504 http://www.securityfocus.com/archive/1/490158/100/0/threaded https://usn.ubuntu.com/944-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/31550/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2008-1391

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect