PT-2008-1110 · Gnome · Vinagre

Alfredo Ortega · Published 2008-12-17 · Updated 2018-10-11 · CVE-2008-5660

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Vinagre versions prior to 0.5.2 Vinagre versions 2.x prior to 2.24.2

Description The issue is related to a format string vulnerability in the vinagre utils show error function, which may allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response. This could lead to a breach of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely.

Recommendations For Vinagre versions prior to 0.5.2, update to version 0.5.2 or later. For Vinagre versions 2.x prior to 2.24.2, update to version 2.24.2 or later.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2015-09371

CVE-2008-5660

Affected Products

Vinagre

References · 18

• 🔥 https://exploit-db.com/exploits/7401 · Exploit
• 🔥 http://coresecurity.com/content/vinagre-format-string · Exploit
• http://secunia.com/advisories/33082 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5660 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-December/msg00485.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-5660 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:240 · Vendor Advisory
• http://ubuntu.com/usn/usn-689-1 · Vendor Advisory
• http://secunia.com/advisories/33046 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-December/msg00473.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-5660 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5660 · Security Note
• https://bdu.fstec.ru/vul/2015-09371 · Security Note
• http://secunia.com/advisories/33041 · Vendor Advisory
• http://securityfocus.com/archive/1/499057/100/0/threaded · Note