Vulnerability Details : CVE-2008-6393
Potential exploit
PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer request with a negative value in a SOCKS5 option, which bypasses a signed integer check and triggers an integer overflow and a heap-based buffer overflow.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2008-6393
- cpe:2.3:a:psi-im:psi:*:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.9.2:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.9.1:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.1.0:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.9.3:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.11:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.8.6:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.9:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
- cpe:2.3:a:psi-im:psi:0.8.7:*:*:*:*:*:*:*When used together with: Jabber » Jabber Client
Exploit prediction scoring system (EPSS) score for CVE-2008-6393
28.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-6393
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2008-6393
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-6393
-
http://www.debian.org/security/2009/dsa-1741
[SECURITY] [DSA 1741-1] New psi packages fix denial of service
-
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00080.html
[SECURITY] Fedora 9 Update: psi-0.12.1-1.fc9
-
http://sourceforge.net/project/shownotes.php?release_id=658912
Page not found - SourceForge.netPatch
-
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2009:006 - openSUSE Security Announce - openSUSE Mailing Lists
-
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00071.html
[SECURITY] Fedora 10 Update: psi-0.12.1-1.fc10
-
http://bugs.gentoo.org/show_bug.cgi?id=252830
252830 – net-im/psi <0.12.1 Remote DoS (CVE-2008-6393)Exploit
-
http://www.securityfocus.com/archive/1/499563
Exploit
-
https://www.exploit-db.com/exploits/7555
Psi Jabber Client (Windows / Linux) - Remote Denial of Service - Multiple dos Exploit
-
http://www.openwall.com/lists/oss-security/2009/02/25/5
oss-security - CVE request: Psi <0.12.1 DoSExploit
-
http://jolmos.blogspot.com/2008/12/psi-remote-integer-overflow.html
PSI remote integer overflow
Jump to