Vulnerabilities > CVE-2008-2149 - Buffer Errors vulnerability in Wordnet 2.0/2.1/3.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Stack-based buffer overflow in the searchwn function in Wordnet 2.0, 2.1, and 3.0 might allow context-dependent attackers to execute arbitrary code via a long command line option. NOTE: this issue probably does not cross privilege boundaries except in cases in which Wordnet is used as a back end.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 3 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1634.NASL description Rob Holland discovered several programming errors in WordNet, an electronic lexical database of the English language. These flaws could allow arbitrary code execution when used with untrusted input, for example when WordNet is in use as a back end for a web application. last seen 2020-06-01 modified 2020-06-02 plugin id 34088 published 2008-09-05 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34088 title Debian DSA-1634-1 : wordnet - stack and heap overflows code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-1634. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(34088); script_version("1.11"); script_cvs_date("Date: 2019/08/02 13:32:21"); script_cve_id("CVE-2008-2149", "CVE-2008-3908"); script_xref(name:"DSA", value:"1634"); script_name(english:"Debian DSA-1634-1 : wordnet - stack and heap overflows"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Rob Holland discovered several programming errors in WordNet, an electronic lexical database of the English language. These flaws could allow arbitrary code execution when used with untrusted input, for example when WordNet is in use as a back end for a web application." ); script_set_attribute( attribute:"see_also", value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=481186" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2008/dsa-1634" ); script_set_attribute( attribute:"solution", value: "Upgrade the wordnet package. For the stable distribution (etch), these problems have been fixed in version 1:2.1-4+etch1." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_cwe_id(119); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:wordnet"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0"); script_set_attribute(attribute:"patch_publication_date", value:"2008/09/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/09/05"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"4.0", prefix:"wordnet", reference:"1:2.1-4+etch1")) flag++; if (deb_check(release:"4.0", prefix:"wordnet-base", reference:"1:2.1-4+etch1")) flag++; if (deb_check(release:"4.0", prefix:"wordnet-dev", reference:"1:2.1-4+etch1")) flag++; if (deb_check(release:"4.0", prefix:"wordnet-sense-index", reference:"1:2.1-4+etch1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2008-182.NASL description Rob Holland found several programming errors in WordNet which could lead to the execution or arbitrary code when used with untrusted input (CVE-2008-2149, CVE-2008-3908). Update : The previous patch had a typo that caused incorrect behaviour in WordNet. This update uses an update patch that corrects the issue and also notes the additional assigned CVE name for these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 36999 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/36999 title Mandriva Linux Security Advisory : wordnet (MDVSA-2008:182-1) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200810-01.NASL description The remote host is affected by the vulnerability described in GLSA-200810-01 (WordNet: Execution of arbitrary code) Jukka Ruohonen initially reported a boundary error within the searchwn() function in src/wn.c. A thorough investigation by the oCERT team revealed several other vulnerabilities in WordNet: Jukka Ruohonen and Rob Holland (oCERT) reported multiple boundary errors within the searchwn() function in src/wn.c, the wngrep() function in lib/search.c, the morphstr() and morphword() functions in lib/morph.c, and the getindex() in lib/search.c, which lead to stack-based buffer overflows. Rob Holland (oCERT) reported two boundary errors within the do_init() function in lib/morph.c, which lead to stack-based buffer overflows via specially crafted last seen 2020-06-01 modified 2020-06-02 plugin id 34365 published 2008-10-08 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/34365 title GLSA-200810-01 : WordNet: Execution of arbitrary code
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 29208 CVE(CAN) ID: CVE-2008-2149 WordNet是普林斯顿大学开发的英语词汇及其词法关系数据库。 WordNet的src/wn.c文件的searchwn()函数以及lib/search.c文件的wngrep()函数在处理发送给wn二进制程序的超长字符串参数时存在栈溢出漏洞: } else { sprintf(tmpbuf, "wn: invalid search option: %s\n", av[j]); display_message(tmpbuf); errcount++; } 远程攻击者可以通过发送带有无效命令行选项的超长字符串请求触发这个溢出,导致拒绝服务的情况。 Princeton University WordNet 3.0 Princeton University -------------------- 目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本: <a href=http://wordnet.princeton.edu/ target=_blank>http://wordnet.princeton.edu/</a> |
id | SSV:3301 |
last seen | 2017-11-19 |
modified | 2008-05-17 |
published | 2008-05-17 |
reporter | Root |
title | WordNet多个栈溢出漏洞 |
References
- http://secunia.com/advisories/30242
- http://secunia.com/advisories/31654
- http://secunia.com/advisories/32184
- http://www.debian.org/security/2008/dsa-1634
- http://www.gentoo.org/security/en/glsa/glsa-200810-01.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:182
- http://www.securityfocus.com/bid/29208
- http://www.vupen.com/english/advisories/2008/1527/references
- https://bugs.gentoo.org/show_bug.cgi?id=211491
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42378