ID CVE-2010-2054
Summary Integer overflow in httpAdapter.c in httpAdapter in SBLIM SFCB 1.3.4 through 1.3.7, when the configuration sets httpMaxContentLength to a zero value, allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a large integer in the Content-Length HTTP header, aka bug #3001915. NOTE: some of these details are obtained from third party information.
References
Vulnerable Configurations
  • cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.7:*:*:*:*:*:*:*
    cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.7:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 15-06-2010 - 14:30)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
refmap via4
confirm
mlist [oss-security] 20100601 SFCB vulnerabilities
secunia 40018
vupen ADV-2010-1312
Last major update 15-06-2010 - 14:30
Published 15-06-2010 - 14:30
Back to Top