PT-2008-6794 · Dahdi · Zaptel

Published 2008-12-26 · Updated 2017-08-08 · CVE-2008-5744

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zaptel (aka DAHDI) versions 1.4.11 and earlier

Description The issue is related to an array index error in the dahdi/tor2.c driver. This error allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl. The problem stems from an incorrect tor2 patch that uses the wrong variable in a range check against the value of lc->sync.

Recommendations For Zaptel (aka DAHDI) versions 1.4.11 and earlier, consider restricting access to the /dev/zap/ctl file to prevent local users from overwriting kernel memory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-5744

DSA-1699-1

Affected Products

Zaptel

References · 7

• 🔥 http://openwall.com/lists/oss-security/2008/12/19/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5744 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=475446#c4 · Note
• http://secunia.com/advisories/32960 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47666 · Note
• http://bugs.digium.com/view.php?id=13954#96700 · Note
• http://svn.digium.com/view/dahdi?view=rev&revision=5590 · Note