Vulnerability CVE-2008-3916


Published: 2008-09-04   Modified: 2011-03-07

Description:
Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

Vendor: GNU
Product: ED 
Version:
0.9
0.8
0.7
0.6
0.5
0.4
0.3
0.2

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00873.html
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00847.html
http://xforce.iss.net/xforce/xfdb/44643
http://www.vupen.com/english/advisories/2011/0212
http://www.vupen.com/english/advisories/2010/0528
http://www.vupen.com/english/advisories/2008/3347
http://www.vupen.com/english/advisories/2008/2642
http://www.vmware.com/security/advisories/VMSA-2009-0003.html
http://www.securitytracker.com/id?1020734
http://www.securityfocus.com/bid/30815
http://www.securityfocus.com/archive/1/archive/1/501298/100/0/threaded
http://www.redhat.com/support/errata/RHSA-2008-0946.html
http://www.mandriva.com/security/advisories?name=MDVSA-2008:200
http://support.avaya.com/elmodocs2/security/ASA-2008-461.htm
http://security.gentoo.org/glsa/glsa-200809-15.xml
http://secunia.com/advisories/43068
http://secunia.com/advisories/38794
http://secunia.com/advisories/33005
http://secunia.com/advisories/32460
http://secunia.com/advisories/32349
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10678
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://lists.gnu.org/archive/html/bug-ed/2008-08/msg00000.html

Related CVE
CVE-2017-12459
The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve co...
CVE-2017-12456
The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.
CVE-2017-12457
The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.
CVE-2017-12458
The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.
CVE-2017-12454
The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.
CVE-2017-12455
The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.
CVE-2017-12452
The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a craf...
CVE-2017-12453
The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

Copyright 2017, cxsecurity.com