PT-2008-2573 · Sun · Snoop

Publicado 2008-08-08 · Atualizado 2018-10-30 · CVE-2008-0965

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions snoop versions on Sun Solaris 8 through 10 and OpenSolaris before snv 96

Description The issue is related to multiple format string vulnerabilities in snoop. These vulnerabilities can be exploited by remote attackers to execute arbitrary code via format string specifiers in an SMB packet when the -o option is omitted.

Recommendations For snoop on Sun Solaris 8 through 10 and OpenSolaris before snv 96, update to a version after snv 96 to resolve the issue. As a temporary workaround, consider using the -o option to minimize the risk of exploitation.

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2008-0965

Produtos afetados

Snoop

Referências · 13

• https://exchange.xforce.ibmcloud.com/vulnerabilities/44222 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5742 · Nota
• http://secunia.com/advisories/31535 · Aviso do Fabricante
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=735 · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2008-355.htm · Nota
• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=766935 · Nota
• http://securitytracker.com/id?1020633 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-240101-1 · Aviso do Fabricante
• http://secunia.com/advisories/31386 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44415 · Nota
• http://securityfocus.com/bid/30556 · Nota
• http://vupen.com/english/advisories/2008/2311 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0965 · Nota de Segurança