CVE-2009-0601 : Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows pla

Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable.

Published 2009-02-16 20:30:03

Updated 2024-05-17 17:31:40

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2009-0601

Wireshark » Wireshark » Version: 0.99.8
cpe:2.3:a:wireshark:wireshark:0.99.8:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Freebsd » Freebsd
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Netbsd » Netbsd
When used together with: SUN » Solaris
Wireshark » Wireshark » Version: 1.0.0
cpe:2.3:a:wireshark:wireshark:1.0.0:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Freebsd » Freebsd
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Netbsd » Netbsd
When used together with: SUN » Solaris
Wireshark » Wireshark » Version: 1.0.1
cpe:2.3:a:wireshark:wireshark:1.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Freebsd » Freebsd
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Netbsd » Netbsd
When used together with: SUN » Solaris
Wireshark » Wireshark » Version: 1.0.2
cpe:2.3:a:wireshark:wireshark:1.0.2:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Freebsd » Freebsd
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Netbsd » Netbsd
When used together with: SUN » Solaris
Wireshark » Wireshark » Version: 1.0.3
cpe:2.3:a:wireshark:wireshark:1.0.3:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Freebsd » Freebsd
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Netbsd » Netbsd
When used together with: SUN » Solaris
Wireshark » Wireshark » Version: 1.0.4
cpe:2.3:a:wireshark:wireshark:1.0.4:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Freebsd » Freebsd
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Netbsd » Netbsd
When used together with: SUN » Solaris
Wireshark » Wireshark » Version: 1.0.5
cpe:2.3:a:wireshark:wireshark:1.0.5:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Freebsd » Freebsd
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Netbsd » Netbsd
When used together with: SUN » Solaris

Exploit prediction scoring system (EPSS) score for CVE-2009-0601

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 15 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-0601

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2009-0601

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2009-0601

Red Hat 2009-02-17

Red Hat does not consider this to be a security issue. For further details, see: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0601#c3

References for CVE-2009-0601

http://www.securityfocus.com/bid/33690

Patch;Third Party Advisory;VDB Entry

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html

[security-announce] SUSE Security Summary Report: SUSE-SR:2009:005 - openSUSE Security Announce - openSUSE Mailing Lists
Mailing List;Third Party Advisory

CVEs referencing this url
http://secunia.com/advisories/34264

About Secunia Research | Flexera
Broken Link
http://wiki.rpath.com/Advisories:rPSA-2009-0040

Third Party Advisory

CVEs referencing this url
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3150

format string crash bug from $HOME (#3150) · Issues · Wireshark Foundation / Wireshark · GitLab
Issue Tracking;Third Party Advisory
http://www.securityfocus.com/archive/1/501763/100/0/threaded

Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.wireshark.org/security/wnpa-sec-2009-01.html

Wireshark • wnpa-sec-2009-01 Multiple problems in Wireshark
Vendor Advisory

CVEs referencing this url
https://issues.rpath.com/browse/RPL-2984

Third Party Advisory

CVEs referencing this url
http://www.vupen.com/english/advisories/2009/0370

Webmail: access your OVH emails on ovhcloud.com | OVHcloud UK
Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id?1021697

GoDaddy Domain Name Search
Third Party Advisory;VDB Entry

CVEs referencing this url