CVE-2005-3863
Stack-based buffer overflow in kkstrtext.h in ktools library 0.3 and earlier, as used in products such as (1) centericq, (2) orpheus, (3) motor, and (4) groan, allows local users or remote attackers to execute arbitrary code via a long parameter to the…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Stack-based buffer overflow in kkstrtext.h in ktools library 0.3 and earlier, as used in products such as (1) centericq, (2) orpheus, (3) motor, and (4) groan, allows local users or remote attackers to execute arbitrary code via a long parameter to the VGETSTRING macro.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 5.16% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- ktools/ktools
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/17768Vendor Advisory
- http://secunia.com/advisories/18081Patch, Vendor Advisory
- http://secunia.com/advisories/20329Vendor Advisory
- http://secunia.com/advisories/20368Patch, Vendor Advisory
- http://secunia.com/advisories/20446Patch, Vendor Advisory
- http://secunia.com/advisories/21684Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200512-11.xml
- http://security.gentoo.org/glsa/glsa-200608-27.xml
- http://www.debian.org/security/2006/dsa-1083Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-1088Patch, Vendor Advisory
- http://www.osvdb.org/21161
- http://www.securityfocus.com/archive/1/417906/100/0/threaded
- http://www.securityfocus.com/bid/15600
- http://www.vupen.com/english/advisories/2005/2605Vendor Advisory
- http://www.vupen.com/english/advisories/2006/2062Vendor Advisory
- http://www.zone-h.org/en/advisories/read/id=8480/Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23233
- http://secunia.com/advisories/17768Vendor Advisory
- http://secunia.com/advisories/18081Patch, Vendor Advisory
- http://secunia.com/advisories/20329Vendor Advisory
- http://secunia.com/advisories/20368Patch, Vendor Advisory
- http://secunia.com/advisories/20446Patch, Vendor Advisory
- http://secunia.com/advisories/21684Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200512-11.xml
- http://security.gentoo.org/glsa/glsa-200608-27.xml
- http://www.debian.org/security/2006/dsa-1083Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-1088Patch, Vendor Advisory
- http://www.osvdb.org/21161
- http://www.securityfocus.com/archive/1/417906/100/0/threaded
- http://www.securityfocus.com/bid/15600
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.