Cscope Reffile Local Buffer Overflow Vulnerability

Bugtraq ID:	19687
Class:	Boundary Condition Error
CVE:	CVE-2006-4262
Remote:	No
Local:	Yes
Published:	Aug 24 2006 12:00AM
Updated:	Jun 16 2009 01:59PM
Credit:	Will Drewry is credited with the discovery of this vulnerability.
Vulnerable:	Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4.8.z Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4.8.z Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Desktop 4.0 Redhat Desktop 3.0 Cscope Cscope 15.5 + SCO Open Server 5.0.7 + SCO Open Server 5.0.6 Cscope Cscope 15.4 Cscope Cscope 15.3 Cscope Cscope 15.1
Not Vulnerable:

Cscope Reffile Local Buffer Overflow Vulnerability

Cscope is prone to a local buffer-overflow vulnerability because it fails to properly validate the size of attacker-supplied data before copying it into a finite-sized buffer.

The issue allows local attackers to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

Cscope 15.x is vulnerable; previous versions may be affected as well.

Cscope Reffile Local Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cscope Reffile Local Buffer Overflow Vulnerability

Solution:
The vendor has released patches. Please see the references for details.

Cscope Reffile Local Buffer Overflow Vulnerability

References:

• cscope ChangeLog,1.158,1.159 (Cscope)
  
• Cscope Home Page (Cscope)
  
• cscope/src build.c, 1.11, 1.12 command.c, 1.31, 1.32 dir.c, 1.27, 1.28 display.c (Cscope)
  
• RHSA-2009:1101 cscope security update (Red Hat)