fkie_cve-2009-0148
Vulnerability from fkie_nvd
Published
2009-05-05 17:30
Modified
2025-04-09 00:30
Severity ?
Summary
Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541.
References
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2009/May/msg00002.html
cve@mitre.orghttp://secunia.com/advisories/34978Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/35074Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/35213Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/35214Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/35462Vendor Advisory
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200905-02.xml
cve@mitre.orghttp://sourceforge.net/forum/forum.php?forum_id=947983Patch
cve@mitre.orghttp://sourceforge.net/mailarchive/forum.php?thread_name=E1LsGx3-00015K-TN%40ddv4jf1.ch3.sourceforge.com&forum_name=cscope-cvs
cve@mitre.orghttp://sourceforge.net/project/shownotes.php?group_id=4664&release_id=679527Patch
cve@mitre.orghttp://support.apple.com/kb/HT3549
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1806
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2009/05/06/9
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2009-1101.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2009-1102.html
cve@mitre.orghttp://www.securityfocus.com/bid/34805
cve@mitre.orghttp://www.securitytracker.com/id?1022218
cve@mitre.orghttp://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1238Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1297Vendor Advisory
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=490667
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9633
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34978Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35074Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35213Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35214Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35462Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200905-02.xml
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/forum/forum.php?forum_id=947983Patch
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/mailarchive/forum.php?thread_name=E1LsGx3-00015K-TN%40ddv4jf1.ch3.sourceforge.com&forum_name=cscope-cvs
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/project/shownotes.php?group_id=4664&release_id=679527Patch
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT3549
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1806
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2009/05/06/9
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2009-1101.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2009-1102.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34805
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022218
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1238Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1297Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=490667
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9633
Impacted products
Vendor Product Version
cscope cscope 13.0
cscope cscope 15.0bl2
cscope cscope 15.1
cscope cscope 15.3
cscope cscope 15.4
cscope cscope 15.5
cscope cscope 15.6
cscope cscope 15.7


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cscope:cscope:13.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "27476BD2-FC3B-46A1-8810-DB3DB29106C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cscope:cscope:15.0bl2:*:*:*:*:*:*:*",
              "matchCriteriaId": "17C00B4F-D84A-4CF6-B4BF-D0F574CBFD42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cscope:cscope:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "78590FBB-C9CE-42B7-83C9-1F5FAD11A2A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cscope:cscope:15.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E821D0F7-D928-4C2F-89DE-7B46968A2970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cscope:cscope:15.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0837A120-86AE-4ABB-AB38-F3D573C5064B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cscope:cscope:15.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2F1D020-6884-4D6D-AB04-88119CB53F9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cscope:cscope:15.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "16BA0384-4466-467D-80E4-44DAE2B70038",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cscope:cscope:15.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "10D85508-318A-43F5-B6C8-E090FB678DAC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in Cscope before 15.7a allow remote attackers to execute arbitrary code via long strings in input such as (1) source-code tokens and (2) pathnames, related to integer overflows in some cases. NOTE: this issue exists because of an incomplete fix for CVE-2004-2541."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desbordamientos de b\u00fafer en Cscope anterior a versi\u00f3n 15.7a, permiten a los atacantes remotos ejecutar c\u00f3digo arbitrario por medio de cadenas largas en entradas como (1) tokens de c\u00f3digo fuente y (2) nombres de ruta, relacionados con desbordamiento de enteros en algunos casos. NOTA: este problema se presenta debido a una correcci\u00f3n incompleta del CVE-2004-2541."
    }
  ],
  "id": "CVE-2009-0148",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-05-05T17:30:00.233",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34978"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35074"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35213"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35214"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35462"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200905-02.xml"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/forum/forum.php?forum_id=947983"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sourceforge.net/mailarchive/forum.php?thread_name=E1LsGx3-00015K-TN%40ddv4jf1.ch3.sourceforge.com\u0026forum_name=cscope-cvs"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?group_id=4664\u0026release_id=679527"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.apple.com/kb/HT3549"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1806"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2009/05/06/9"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1101.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1102.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/34805"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1022218"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1238"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1297"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=490667"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9633"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2009/May/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34978"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35074"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35213"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35214"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/35462"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200905-02.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/forum/forum.php?forum_id=947983"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/mailarchive/forum.php?thread_name=E1LsGx3-00015K-TN%40ddv4jf1.ch3.sourceforge.com\u0026forum_name=cscope-cvs"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://sourceforge.net/project/shownotes.php?group_id=4664\u0026release_id=679527"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT3549"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1806"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2009/05/06/9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1101.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1102.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/34805"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1022218"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-133A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1238"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1297"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=490667"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9633"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.