CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Vulnerability Details : CVE-2004-0914

Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.
Publish Date : 2005-01-10 Last Update Date : 2010-08-21
Search Twitter   Search YouTube   Search Google

- CVSS Scores & Vulnerability Types

CVSS Score
10.0
Confidentiality Impact Complete (There is total information disclosure, resulting in all system files being revealed.)
Integrity Impact Complete (There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.)
Availability Impact Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.)
Access Complexity Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication Not required (Authentication is not required to exploit the vulnerability.)
Gained Access Admin
Vulnerability Type(s) Denial Of ServiceExecute CodeOverflowDirectory traversalObtain Information
CWE ID CWE id is not defined for this vulnerability

- Vendor Statements

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Source: Redhat

- Additional Vendor Supplied Data

Vendor Impact CVSS Score CVSS Vector Report Date Publish Date
Redhat moderate 2004-11-17
If you are a vendor and you have additional data which can be automatically imported into our database, please contact admin @ cvedetails.com

- Related OVAL Definitions

Title Definition Id Class Family
Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple in... oval:org.mitre.oval:def:9943 unix
RHSA-2004:537: openmotif security update (Important) oval:com.redhat.rhsa:def:2004537 unix
RHSA-2004:537: openmotif security update (Important) oval:com.redhat.rhsa:def:20040537 unix
RHSA-2004:612: XFree86 security update (Moderate) oval:com.redhat.rhsa:def:2004612 unix
RHSA-2004:612: XFree86 security update (Moderate) oval:com.redhat.rhsa:def:20040612 unix
OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2004-0914

# Product Type Vendor Product Version Update Edition Language
1 OS Gentoo Linux Version Details Vulnerabilities
2 Application Lesstif Lesstif 0.93 Version Details Vulnerabilities
3 Application Lesstif Lesstif 0.93.12 Version Details Vulnerabilities
4 Application Lesstif Lesstif 0.93.18 Version Details Vulnerabilities
5 Application Lesstif Lesstif 0.93.34 Version Details Vulnerabilities
6 Application Lesstif Lesstif 0.93.36 Version Details Vulnerabilities
7 Application Lesstif Lesstif 0.93.40 Version Details Vulnerabilities
8 Application Lesstif Lesstif 0.93.91 Version Details Vulnerabilities
9 Application Lesstif Lesstif 0.93.94 Version Details Vulnerabilities
10 Application Lesstif Lesstif 0.93.96 Version Details Vulnerabilities
11 OS Redhat Fedora Core Core 2.0 Version Details Vulnerabilities
12 OS Redhat Fedora Core Core 3.0 Version Details Vulnerabilities
13 OS Suse Suse Linux 1.0 Desktop Version Details Vulnerabilities
14 OS Suse Suse Linux 8 Enterprise Server Version Details Vulnerabilities
15 OS Suse Suse Linux 8.1 Version Details Vulnerabilities
16 OS Suse Suse Linux 8.2 Version Details Vulnerabilities
17 OS Suse Suse Linux 9.0 Enterprise Server Version Details Vulnerabilities
18 OS Suse Suse Linux 9.0 Version Details Vulnerabilities
19 OS Suse Suse Linux 9.1 Version Details Vulnerabilities
20 OS Suse Suse Linux 9.2 Version Details Vulnerabilities
21 Application X.org X11r6 6.7.0 Version Details Vulnerabilities
22 Application X.org X11r6 6.8 Version Details Vulnerabilities
23 Application X.org X11r6 6.8.1 Version Details Vulnerabilities
24 Application Xfree86 Project X11r6 3.3 Version Details Vulnerabilities
25 Application Xfree86 Project X11r6 3.3.2 Version Details Vulnerabilities
26 Application Xfree86 Project X11r6 3.3.3 Version Details Vulnerabilities
27 Application Xfree86 Project X11r6 3.3.4 Version Details Vulnerabilities
28 Application Xfree86 Project X11r6 3.3.5 Version Details Vulnerabilities
29 Application Xfree86 Project X11r6 3.3.6 Version Details Vulnerabilities
30 Application Xfree86 Project X11r6 4.0 Version Details Vulnerabilities
31 Application Xfree86 Project X11r6 4.0.1 Version Details Vulnerabilities
32 Application Xfree86 Project X11r6 4.0.2.11 Version Details Vulnerabilities
33 Application Xfree86 Project X11r6 4.0.3 Version Details Vulnerabilities
34 Application Xfree86 Project X11r6 4.1.0 Version Details Vulnerabilities
35 Application Xfree86 Project X11r6 4.1.11 Version Details Vulnerabilities
36 Application Xfree86 Project X11r6 4.1.12 Version Details Vulnerabilities
37 Application Xfree86 Project X11r6 4.2.0 Version Details Vulnerabilities
38 Application Xfree86 Project X11r6 4.2.1 Errata Version Details Vulnerabilities
39 Application Xfree86 Project X11r6 4.2.1 Version Details Vulnerabilities
40 Application Xfree86 Project X11r6 4.3.0 Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor Product Vulnerable Versions
Gentoo Linux 1
Lesstif Lesstif 9
Redhat Fedora Core 2
Suse Suse Linux 8
X.org X11r6 3
Xfree86 Project X11r6 17

- References For CVE-2004-0914

http://www.mandriva.com/security/advisories?name=MDKSA-2004:137
MANDRAKE MDKSA-2004:137
http://rhn.redhat.com/errata/RHSA-2004-537.html
REDHAT RHSA-2004:537
http://secunia.com/advisories/13224/
SECUNIA 13224
http://www.gentoo.org/security/en/glsa/glsa-200502-07.xml
GENTOO GLSA-200502-07
http://www.redhat.com/archives/fedora-legacy-announce/2006-January/msg00001.html
FEDORA FLSA-2006:152803
http://www.linuxsecurity.com/content/view/106877/102/
FEDORA FEDORA-2004-433
http://www.redhat.com/support/errata/RHSA-2004-610.html
REDHAT RHSA-2004:610
http://www.ubuntu.com/usn/usn-83-1
UBUNTU USN-83-1
http://www.redhat.com/support/errata/RHSA-2005-004.html
REDHAT RHSA-2005:004
http://xforce.iss.net/xforce/xfdb/18142
XF libxpm-image-bo(18142):
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTU01228
HP HPSBTU01228
http://www.x.org/pub/X11R6.8.1/patches/README.xorg-681-CAN-2004-0914.patch CONFIRM
http://www.ubuntu.com/usn/usn-83-2
UBUNTU USN-83-2
http://xforce.iss.net/xforce/xfdb/18146
XF libxpm-directory-traversal(18146):
http://xforce.iss.net/xforce/xfdb/18144
XF libxpm-improper-memory-access(18144):
http://xforce.iss.net/xforce/xfdb/18145
XF libxpm-command-execution(18145):
http://www.gentoo.org/security/en/glsa/glsa-200502-06.xml
GENTOO GLSA-200502-06
http://xforce.iss.net/xforce/xfdb/18147
XF libxpm-dos(18147)
http://www.debian.org/security/2004/dsa-607
DEBIAN DSA-607
http://www.gentoo.org/security/en/glsa/glsa-200411-28.xml
GENTOO GLSA-200411-28
http://www.securityfocus.com/bid/11694
BID 11694 LibXPM Multiple Unspecified Vulnerabilities Release Date:2008-07-02

- Metasploit Modules Related To CVE-2004-0914

There are not any metasploit modules related to this vulnerability (Please visit www.metasploit.com for more information)


CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.