1. CVE-Search
  2. CVE-2008-2654
ID CVE-2008-2654
Summary Off-by-one error in the read_client function in webhttpd.c in Motion 3.2.10 and earlier might allow remote attackers to execute arbitrary code via a long request to a Motion HTTP Control interface, which triggers a stack-based buffer overflow with some combinations of processor architecture and compiler.
References
Vulnerable Configurations
  • cpe:2.3:a:lavrsen:motion:3.1.17:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.1.17:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.1.18:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.1.18:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.1.19:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.1.19:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.1.20:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.1.20:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:3.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:3.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:lavrsen:motion:*:*:*:*:*:*:*:*
    cpe:2.3:a:lavrsen:motion:*:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 08-08-2017 - 01:31)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
refmap via4
bid 29636
confirm
gentoo GLSA-200807-02
mlist
  • [oss-security] 20080610 Re: exploitability of off-by-one in motion webserver
  • [oss-security] 20080610 exploitability of off-by-one in motion webserver
  • [oss-security] 20080611 Re: exploitability of off-by-one in motion webserver
secunia
  • 30544
  • 30864
vupen ADV-2008-1796
xf motion-readclient-bo(42979)
Last major update 08-08-2017 - 01:31
Published 13-06-2008 - 18:41
Last modified 08-08-2017 - 01:31
Back to Top