Cscope Include Filename Buffer Overflow Vulnerability
BID:18050
Info
Cscope Include Filename Buffer Overflow Vulnerability
| Bugtraq ID: | 18050 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-2541 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 11 2004 12:00AM |
| Updated: | Jun 16 2009 02:19PM |
| Credit: | Jason Duell is credited with the discovery of this vulnerability. |
| Vulnerable: |
Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux EUS 5.3.z server Redhat Enterprise Linux ES 4.8.z Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4.8.z Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux 5 Server Redhat Desktop 4.0 Redhat Desktop 3.0 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Cscope Cscope 15.5 Cscope Cscope 15.4 Cscope Cscope 15.3 Cscope Cscope 15.1 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.3.9 Apple Mac OS X 10.4.10 Apple Mac OS X 10.3.9 |
| Not Vulnerable: | |
Discussion
Cscope Include Filename Buffer Overflow Vulnerability
Cscope is prone to a buffer-overflow vulnerability because it fails to properly validate the size of attacker-supplied data before copying it into a finite-sized buffer.
Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.
Cscope is prone to a buffer-overflow vulnerability because it fails to properly validate the size of attacker-supplied data before copying it into a finite-sized buffer.
Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.
Exploit / POC
Cscope Include Filename Buffer Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Cscope Include Filename Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references for details.
Apple Mac OS X Server 10.3.9
Apple Mac OS X 10.3.9
Apple Mac OS X 10.4.10
Apple Mac OS X Server 10.4.10
Cscope Cscope 15.3
Cscope Cscope 15.5
Solution:
Updates are available. Please see the references for details.
Apple Mac OS X Server 10.3.9
-
Apple SecUpdSrvr2007-007Pan.dmg For Mac OS X Server v10.3.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.3.9
-
Apple SecUpd2007-007Pan.dmg For Mac OS X v10.3.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.4.10
-
Apple SecUpd2007-007Ti.dmg For Mac OS X v10.4.10 (PowerPC)
http://www.apple.com/support/downloads/ -
Apple SecUpd2007-007Univ.dmg For Mac OS X v10.4.10 (Universal)
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.10
-
Apple SecUpdSrvr2007-007Ti.dmg For Mac OS X Server v10.4.10 (PowerPC)
http://www.apple.com/support/downloads/ -
Apple SecUpdSrvr2007-007Universal.dmg For Mac OS X Server v10.4.10 (Universal)
http://www.apple.com/support/downloads/
Cscope Cscope 15.3
-
Debian cscope_15.3-1woody3_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_alpha.deb -
Debian cscope_15.3-1woody3_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_arm.deb -
Debian cscope_15.3-1woody3_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_hppa.deb -
Debian cscope_15.3-1woody3_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_i386.deb -
Debian cscope_15.3-1woody3_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_ia64.deb -
Debian cscope_15.3-1woody3_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_m68k.deb -
Debian cscope_15.3-1woody3_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_mips.deb -
Debian cscope_15.3-1woody3_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_mipsel.deb -
Debian cscope_15.3-1woody3_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_powerpc.deb -
Debian cscope_15.3-1woody3_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_s390.deb -
Debian cscope_15.3-1woody3_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.3-1woo dy3_sparc.deb
Cscope Cscope 15.5
-
Debian cscope_15.5-1.1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_alpha.deb -
Debian cscope_15.5-1.1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_amd64.deb -
Debian cscope_15.5-1.1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_arm.deb -
Debian cscope_15.5-1.1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_hppa.deb -
Debian cscope_15.5-1.1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_i386.deb -
Debian cscope_15.5-1.1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_ia64.deb -
Debian cscope_15.5-1.1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_m68k.deb -
Debian cscope_15.5-1.1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_mips.deb -
Debian cscope_15.5-1.1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_mipsel.deb -
Debian cscope_15.5-1.1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_powerpc.deb -
Debian cscope_15.5-1.1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_s390.deb -
Debian cscope_15.5-1.1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cscope/cscope_15.5-1.1s arge1_sparc.deb
References
Cscope Include Filename Buffer Overflow Vulnerability
References:
References:
- cscope ChangeLog,1.158,1.159 (Cscope)
- Cscope Home Page (Cscope)
- RHSA-2009:1101 cscope security update (Red Hat)
- RHSA-2009:1102 cscope security update (Red Hat)