Vulnerability Details : CVE-2010-1147
Stack-based buffer overflow in Open Direct Connect Hub (aka Open DC Hub or OpenDCHub) 0.8.1 allows remote authenticated users to execute arbitrary code via a long MyINFO message.
Vulnerability category: OverflowExecute code
Exploit prediction scoring system (EPSS) score for CVE-2010-1147
Probability of exploitation activity in the next 30 days: 51.86%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 97 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-1147
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.0
|
MEDIUM | AV:N/AC:M/Au:S/C:P/I:P/A:P |
6.8
|
6.4
|
NIST |
CWE ids for CVE-2010-1147
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-1147
-
http://www.vupen.com/english/advisories/2010/1044
Webmail | OVH- OVH
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576308
#576308 - OpenDcHub 0.8.1 Remote Code Execution Exploit - Debian Bug report logs
-
http://www.indahax.com/exploits/opendchub-0-8-1-remote-code-execution-exploit#more-600
Exploit
-
http://openwall.com/lists/oss-security/2010/04/03/1
oss-security - CVE Request -- OpenDCHub v0.8.1 -- Stack overflow by handling a specially-crafted MyINFO message
-
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040380.html
[SECURITY] Fedora 12 Update: opendchub-0.8.2-2.fc12
-
https://bugzilla.redhat.com/show_bug.cgi?id=579206
579206 – (CVE-2010-1147) CVE-2010-1147 OpenDCHub v0.8.1: Stack overflow by handling a specially-crafted MyINFO message
-
http://www.securityfocus.com/bid/39129
Open DC Hub 'MyInfo' Message Remote Stack Buffer Overflow Vulnerability
-
http://www.securityfocus.com/archive/1/510428
SecurityFocusExploit
-
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040360.html
[SECURITY] Fedora 13 Update: opendchub-0.8.2-2.fc13
-
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040421.html
[SECURITY] Fedora 11 Update: opendchub-0.8.2-2.fc11
-
http://www.vupen.com/english/advisories/2010/1023
Webmail | OVH- OVH
-
http://marc.info/?l=oss-security&m=127051570728944&w=2
'Re: [oss-security] CVE Request -- OpenDCHub v0.8.1 -- Stack' - MARC
Products affected by CVE-2010-1147
- cpe:2.3:a:roshan_singh:open_direct_connect_hub:0.8.1:*:*:*:*:*:*:*