Yosemite Backup 'DtbClsLogin()' Remote Buffer Overflow Vulnerability

Bugtraq ID:	32246
Class:	Boundary Condition Error
CVE:	CVE-2008-5177
Remote:	Yes
Local:	No
Published:	Nov 11 2008 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	Abdul-Aziz Hariri
Vulnerable:	Yosemite Backup 8.70
Not Vulnerable:

Yosemite Backup 'DtbClsLogin()' Remote Buffer Overflow Vulnerability

Yosemite Backup is prone to a buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application or cause a denial-of-service condition.

NOTE: Reports indicate that successful exploits allow remote code execution on Linux systems and denial of service on Windows systems.

Yosemite Backup 8.70 is vulnerable; other versions may also be affected.

Yosemite Backup 'DtbClsLogin()' Remote Buffer Overflow Vulnerability

The following exploit is available. Please note that Symantec has not tested or verified this exploit.

• /data/vulnerabilities/exploits/32246.py

Yosemite Backup 'DtbClsLogin()' Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Yosemite Backup 'DtbClsLogin()' Remote Buffer Overflow Vulnerability

References:

• Yosemite Backup Server Products (Yosemite)