Vulnerability CVE-2009-0363
Published: 2009-02-17   Modified: 2012-02-13

Description:
Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b) owl 2.1.11 allow remote attackers to execute arbitrary code via vectors involving (1) a crafted zcrypt message, related to zcrypt.c; (2) a reply command on a message with a Zephyr Cc: list, related to zwrite.c; and unspecified other use of the products.

Type:

CWE-119

 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Ktools -> OWL 
Barnowl -> Barnowl 

 References:
https://bugs.launchpad.net/ubuntu/+source/owl/+bug/329165
http://xforce.iss.net/xforce/xfdb/48824
http://www.mail-archive.com/debian-testing-security-announce@lists.debian.org/msg00173.html
http://bugs.debian.org/515118
http://barnowl.mit.edu/wiki/barnowl-1.0.5-announce
http://barnowl.mit.edu/browser/ChangeLog
Copyright 2024, cxsecurity.com

 

Back to Top