PT-2007-5181 · Fsplib · Fsplib

Published 2007-07-25 · Updated 2008-11-15 · CVE-2007-3961

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: fsplib versions prior to 0.9

Description: The issue is caused by an off-by-one error in the fsp readdir r function, which can lead to a denial of service when encountering a directory entry with a length of exactly MAXNAMELEN, preventing a terminating null byte from being added.

Recommendations: For versions prior to 0.9, update to version 0.9 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-3961

Affected Products

Fsplib

References · 10

• http://secunia.com/advisories/26184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3961 · Security Note
• http://security.gentoo.org/glsa/glsa-200711-01.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:018 · Vendor Advisory
• http://osvdb.org/38568 · Note
• http://fsp.cvs.sourceforge.net/fsp/fsplib/fsplib.c?r1=1.19&r2=1.20 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=188252 · Note
• http://secunia.com/advisories/26378 · Note
• http://secunia.com/advisories/27501 · Note
• http://fsp.cvs.sourceforge.net/fsp/fsplib/ChangeLog?revision=1.17&view=markup · Note