FKIE_CVE-2011-2903

Vulnerability from fkie_nvd - Published: 2011-09-02 16:55 - Updated: 2026-06-16 23:32
Severity
Summary
Heap-based buffer overflow in tcptrack before 1.4.2 might allow attackers to execute arbitrary code via a long command line argument. NOTE: this is only a vulnerability in limited scenarios in which tcptrack is "configured as a handler for other applications." This issue might not qualify for inclusion in CVE.
References
secalert@redhat.comhttp://seclists.org/oss-sec/2011/q3/293
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2011/08/31/1
secalert@redhat.comhttp://www.rhythm.cx/~steve/devel/tcptrack/Patch
secalert@redhat.comhttp://www.securityfocus.com/bid/49352
secalert@redhat.comhttps://bugs.gentoo.org/show_bug.cgi?id=377917
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=729096Patch
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/69467
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/oss-sec/2011/q3/293
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/08/31/1
af854a3a-2127-422b-91ae-364da2661108http://www.rhythm.cx/~steve/devel/tcptrack/Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/49352
af854a3a-2127-422b-91ae-364da2661108https://bugs.gentoo.org/show_bug.cgi?id=377917
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=729096Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/69467
Impacted products
Vendor Product Version
rhythm tcptrack *
rhythm tcptrack 1.0.0
rhythm tcptrack 1.0.1
rhythm tcptrack 1.0.2
rhythm tcptrack 1.1
rhythm tcptrack 1.1
rhythm tcptrack 1.1.0
rhythm tcptrack 1.1.1
rhythm tcptrack 1.1.2
rhythm tcptrack 1.1.3
rhythm tcptrack 1.1.4
rhythm tcptrack 1.1.5
rhythm tcptrack 1.2.0
rhythm tcptrack 1.3.0
rhythm tcptrack 1.4.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE8F756F-F479-47F9-B9CD-32C84DECB62D",
              "versionEndIncluding": "1.4.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0505E0D4-EE25-40CC-8498-B750F6EA1706",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4ACCB71-8703-42B8-B2A4-254638342B78",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "868D560B-411D-4D92-8972-2820DFE26017",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "34162318-DCDC-49CA-932C-39EF6BFA8797",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "6A122080-F32A-4913-B59B-2137C62A5DD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD68EA3E-BB47-4CF2-BC1D-2E87066DAFBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C0C1E91-CE04-4CBF-9BA6-B6F844B2D881",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "85BE6467-BDD4-41B0-8BE3-3EF8DC482B10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "341F8D6F-7A5B-4906-9F93-D9096CBEBDAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3E3C0AF-2CF2-4E86-AAAE-817D5F9FBAE7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "E40367CA-1996-494F-935B-2956B97B2036",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EC7E8B2-835F-481B-AD71-FB7F1D94F80E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D247729A-CC40-488C-963A-B7C545C1AFAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rhythm:tcptrack:1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "86D43D1A-EAA2-4B84-9A0A-5151C07D5B4C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in tcptrack before 1.4.2 might allow attackers to execute arbitrary code via a long command line argument. NOTE: this is only a vulnerability in limited scenarios in which tcptrack is \"configured as a handler for other applications.\" This issue might not qualify for inclusion in CVE."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de bufer basado en memoria din\u00e1mica en tcptrack antes de v1.4.2 podr\u00eda permitir a atacantes ejecutar codigo de su elecci\u00f3n a trav\u00e9s de un argumento de linea de comando largo. NOTA: esta es solamente un vulnerabilidad en escenarios limitados en los que tcptrack est\u00e1 \"configurado como manejador para otras aplicaciones\". Este fallo puede on estar cualificado para inclusi\u00f3n en CVE."
    }
  ],
  "id": "CVE-2011-2903",
  "lastModified": "2026-06-16T23:32:13.190",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-09-02T16:55:05.677",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://seclists.org/oss-sec/2011/q3/293"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2011/08/31/1"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://www.rhythm.cx/~steve/devel/tcptrack/"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/49352"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=377917"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=729096"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69467"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/oss-sec/2011/q3/293"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2011/08/31/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.rhythm.cx/~steve/devel/tcptrack/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/49352"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugs.gentoo.org/show_bug.cgi?id=377917"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=729096"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69467"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.