PT-2005-3653 · University Of Minnesota · University Of Minnesota Gopher Client
Vade79
·
Publicado
2005-09-02
·
Atualizado
2017-07-11
·
CVE-2005-2772
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
University of Minnesota gopher client version 3.0.9
Description
The issue is related to multiple stack-based buffer overflows. These overflows can be triggered by a remote malicious server through specific actions, including sending a long "+VIEWS:" reply that is not properly handled in the
VIfromLine function, and passing certain arguments when launching third-party programs, such as a web browser from a web link, which is not properly handled in the FIOgetargv function.Recommendations
For University of Minnesota gopher client version 3.0.9, consider disabling the
VIfromLine and FIOgetargv functions as a temporary workaround until a patch is available. Restrict access to launching third-party programs from web links to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
University Of Minnesota Gopher Client