CVE-2009-0537
Summary
| CVE | CVE-2009-0537 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-03-09 21:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
CompleteAV:L/AC:L/Au:N/C:N/I:N/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Microsoft | Interix | 6.0 | All | 10.0.6030.0 | All |
| Operating System | Openbsd | Openbsd | 2.0 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.1 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.2 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.3 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.4 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.5 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.6 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.7 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.8 | All | All | All |
| Operating System | Openbsd | Openbsd | 2.9 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.0 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.1 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.2 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.3 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.4 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.5 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.6 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.7 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.8 | All | All | All |
| Operating System | Openbsd | Openbsd | 3.9 | All | All | All |
| Operating System | Openbsd | Openbsd | 4.0 | All | All | All |
| Operating System | Openbsd | Openbsd | 4.1 | All | All | All |
| Operating System | Openbsd | Openbsd | 4.2 | All | All | All |
| Operating System | Openbsd | Openbsd | 4.3 | All | All | All |
| Operating System | Openbsd | Openbsd | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 410 Gone | af854a3a-2127-422b-91ae-364da2661108 | www.openbsd.org | |
| Libc - 'libc:fts_*()' Local Denial of Service - BSD dos Exploit | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | |
| Multiple Vendor libc 'fts.c' Denial of Service Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit |
| OpenBSD libc fts Function Bug Lets Local Users Deny Service - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| SecurityReason.com - libc:fts_*():multiple vendors, Denial-of-service ( Research Advisory ) | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVS log for src/lib/libc/gen/fts.c | af854a3a-2127-422b-91ae-364da2661108 | www.openbsd.org | Vendor Advisory |
| Error | MITRE | www.openbsd.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.