PT-2009-1084 · Gnu · Gnu Mpfr

Pinar Yanardag · Published 2009-03-03 · Updated 2009-05-13 · CVE-2009-0757

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU MPFR version 2.4.0 GNU MPFR versions prior to 2.4.1

Description The issue concerns buffer overflows in the mpfr snprintf and mpfr vsnprintf functions, which can be exploited by context-dependent attackers to cause a denial of service, resulting in a crash. The vulnerability can also lead to violations of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely.

Recommendations For GNU MPFR version 2.4.0, update to version 2.4.1 or later to resolve the issue. For GNU MPFR versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. As a temporary workaround, consider disabling the use of the mpfr snprintf and mpfr vsnprintf functions until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-09385

CVE-2009-0757

Affected Products

Gnu Mpfr

References · 9

• https://bdu.fstec.ru/vul/2015-09385 · Security Note
• http://ubuntu.com/usn/USN-772-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0757 · Security Note
• http://openwall.com/lists/oss-security/2009/03/02/4 · Patch
• http://mpfr.loria.fr/mpfr-2.4.1 · Vendor Advisory
• http://securityfocus.com/bid/33945 · Note
• http://security.gentoo.org/glsa/glsa-200903-13.xml · Note
• http://secunia.com/advisories/34204 · Note
• http://secunia.com/advisories/35028 · Note