oss-security - Re: CVE request: httrack buffer overflow

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 4 Aug 2008 12:37:28 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Thijs Kinkhorst <thijs@...ian.org>
cc: oss-security@...ts.openwall.com, coley@...re.org
Subject: Re: CVE request: httrack buffer overflow

On Mon, 4 Aug 2008, Thijs Kinkhorst wrote:

> On Monday 4 August 2008 12:21, Tomas Hoger wrote:
> > CVE-2008-3429 ?
> >
> > Buffer overflow in URI processing in HTTrack and WinHTTrack before
> > 3.42-3 allows remote attackers to cause a denial of service (crash) and
> > possibly execute arbitrary code via a long URL.
> >
> > http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3429
>
> Thanks! I somehow missed that one...

It's in NVD but not yet on the public CVE site, due to various process
oddities.  98% of the time, NVD will have the CVEs before the CVE web site
does.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.