PT-2009-5208 · Nasa · Nasa Common Data Format

Alex Legler · Published 2009-08-18 · Updated 2009-08-21 · CVE-2009-2850

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NASA Common Data Format (CDF) (affected versions not specified)

Description The issue involves multiple buffer overflows that can be exploited by context-dependent attackers to execute arbitrary code. This is demonstrated through errors in various functions, including an array index error in the ReadAEDRList64 function, and other errors in the SearchForRecord r 64 and LastRecord64 functions, as well as the CDFsel64 function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-2850

Affected Products

Nasa Common Data Format

References · 5

• 🔥 http://securityfocus.com/archive/1/505123/30/0/threaded · Exploit
• http://cdf.gsfc.nasa.gov/html/CDF_v330.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2850 · Security Note
• http://cdf.gsfc.nasa.gov/html/CDF_changesnote2.html · Note
• http://openwall.com/lists/oss-security/2009/08/14/3 · Note