10.0
CRITICAL
CVE-2008-0122
ISC BIND libbind Inet Network Off-by-One Stack Overflow Vulnerability
Description
Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted input that triggers memory corruption.
INFO
Published Date :
Jan. 16, 2008, 2 a.m.
Last Modified :
Aug. 1, 2019, 12:12 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
10.0
Exploitability Score :
10.0
Public PoC/Exploit Available at Github
CVE-2008-0122 has a 3 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2008-0122.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Updated: 3 years, 2 months ago
0 stars
0 fork
0 watcher
Born at : July 17, 2021, 11:28 a.m.
This repo has been linked 3 different CVEs too.
None
Updated: 1 year, 2 months ago
2 stars
0 fork
0 watcher
Born at : July 16, 2021, 10:59 a.m.
This repo has been linked 3 different CVEs too.
This repo walks through metasploitable1 machine and try to get root access by various methods through various vulnerable services
Updated: 1 year, 8 months ago
2 stars
0 fork
0 watcher
Born at : July 13, 2021, 1:58 a.m.
This repo has been linked 4 different CVEs too.
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2008-0122 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2008-0122 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
Modified Analysis by [email protected]
Aug. 01, 2019
Action Type Old Value New Value Changed Reference Type http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html No Types Assigned http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html Mailing List, Third Party Advisory Changed Reference Type http://secunia.com/advisories/28367 Vendor Advisory http://secunia.com/advisories/28367 Third Party Advisory Changed Reference Type http://secunia.com/advisories/28429 Vendor Advisory http://secunia.com/advisories/28429 Third Party Advisory Changed Reference Type http://secunia.com/advisories/28487 Vendor Advisory http://secunia.com/advisories/28487 Third Party Advisory Changed Reference Type http://secunia.com/advisories/28579 Vendor Advisory http://secunia.com/advisories/28579 Third Party Advisory Changed Reference Type http://secunia.com/advisories/29161 Vendor Advisory http://secunia.com/advisories/29161 Third Party Advisory Changed Reference Type http://secunia.com/advisories/29323 Vendor Advisory http://secunia.com/advisories/29323 Third Party Advisory Changed Reference Type http://secunia.com/advisories/30313 Vendor Advisory http://secunia.com/advisories/30313 Third Party Advisory Changed Reference Type http://secunia.com/advisories/30538 Vendor Advisory http://secunia.com/advisories/30538 Third Party Advisory Changed Reference Type http://secunia.com/advisories/30718 Vendor Advisory http://secunia.com/advisories/30718 Third Party Advisory Changed Reference Type http://sunsolve.sun.com/search/document.do?assetkey=1-26-238493-1 No Types Assigned http://sunsolve.sun.com/search/document.do?assetkey=1-26-238493-1 Broken Link Changed Reference Type http://support.avaya.com/elmodocs2/security/ASA-2008-244.htm No Types Assigned http://support.avaya.com/elmodocs2/security/ASA-2008-244.htm Third Party Advisory Changed Reference Type http://www.kb.cert.org/vuls/id/203611 US Government Resource http://www.kb.cert.org/vuls/id/203611 Third Party Advisory, US Government Resource Changed Reference Type http://www.redhat.com/support/errata/RHSA-2008-0300.html Vendor Advisory http://www.redhat.com/support/errata/RHSA-2008-0300.html Third Party Advisory Changed Reference Type http://www.securityfocus.com/archive/1/487000/100/0/threaded No Types Assigned http://www.securityfocus.com/archive/1/487000/100/0/threaded Third Party Advisory, VDB Entry Changed Reference Type http://www.securityfocus.com/bid/27283 Patch http://www.securityfocus.com/bid/27283 Patch, Third Party Advisory, VDB Entry Changed Reference Type http://www.securitytracker.com/id?1019189 No Types Assigned http://www.securitytracker.com/id?1019189 Third Party Advisory, VDB Entry Changed Reference Type http://www.vupen.com/english/advisories/2008/0193 Vendor Advisory http://www.vupen.com/english/advisories/2008/0193 Permissions Required Changed Reference Type http://www.vupen.com/english/advisories/2008/0703 Vendor Advisory http://www.vupen.com/english/advisories/2008/0703 Permissions Required Changed Reference Type http://www.vupen.com/english/advisories/2008/1743/references Vendor Advisory http://www.vupen.com/english/advisories/2008/1743/references Permissions Required Changed Reference Type http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX61&path=/200802/SECURITY/20080227/datafile123640&label=AIX%20libc%20inet_network%20buffer%20overflow No Types Assigned http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX61&path=/200802/SECURITY/20080227/datafile123640&label=AIX%20libc%20inet_network%20buffer%20overflow Third Party Advisory Changed Reference Type http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4167 No Types Assigned http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4167 Third Party Advisory Changed Reference Type https://bugzilla.redhat.com/show_bug.cgi?id=429149 No Types Assigned https://bugzilla.redhat.com/show_bug.cgi?id=429149 Issue Tracking, Third Party Advisory Changed Reference Type https://exchange.xforce.ibmcloud.com/vulnerabilities/39670 No Types Assigned https://exchange.xforce.ibmcloud.com/vulnerabilities/39670 Third Party Advisory, VDB Entry Changed Reference Type https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 No Types Assigned https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 Third Party Advisory Changed Reference Type https://issues.rpath.com/browse/RPL-2169 No Types Assigned https://issues.rpath.com/browse/RPL-2169 Third Party Advisory Changed Reference Type https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10190 No Types Assigned https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10190 Third Party Advisory Changed Reference Type https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00781.html No Types Assigned https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00781.html Third Party Advisory Changed Reference Type https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00782.html No Types Assigned https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00782.html Third Party Advisory Removed CPE Configuration AND OR cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* versions up to (including) 6.2 cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* versions up to (including) 6.3 cpe:2.3:o:freebsd:freebsd:*:pre-release:*:*:*:*:*:* versions up to (including) 7.0 OR *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions up to (including) 9.4.2 Added CPE Configuration AND OR *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions up to (including) 9.4.2 OR cpe:2.3:o:freebsd:freebsd:6.2:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p12:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:rc1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.2:rc2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p12:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p13:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p14:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p15:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.3:rc2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:6.4:p9:*:*:*:*:*:* -
CVE Modified by [email protected]
Oct. 15, 2018
Action Type Old Value New Value Removed Reference http://www.securityfocus.com/archive/1/archive/1/487000/100/0/threaded [No Types Assigned] Added Reference http://www.securityfocus.com/archive/1/487000/100/0/threaded [No Types Assigned] -
CVE Modified by [email protected]
Sep. 29, 2017
Action Type Old Value New Value Removed Reference http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10190 [No Types Assigned] Added Reference https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10190 [No Types Assigned] -
CVE Modified by [email protected]
Aug. 08, 2017
Action Type Old Value New Value Removed Reference http://xforce.iss.net/xforce/xfdb/39670 [No Types Assigned] Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/39670 [No Types Assigned] -
CVE Modified by [email protected]
Dec. 07, 2016
Action Type Old Value New Value Removed Reference http://marc.info/?l=bugtraq&m=145408644227561&w=2 [No Types Assigned] Added Reference https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 [No Types Assigned] -
CVE Translated by [email protected]
Aug. 20, 2016
Action Type Old Value New Value Removed Translation Error de superación de límite (off-by-one) de la función inet_network en ISC BIND 9.4.2 y anteriores, de la versión de FreeBSD 6.2 a la 7.0-PRERELEASE, permite a atacantes dependientes del contexto provocar denegación de servicio (caida) y posiblemente ejecutar código de su elección a través de entradas manipuladas que disparan corrupción de memoria. Added Translation Error por un paso en la función inet_network en libbind en ISC BIND 9.4.2 y versiones anteriores, como se utiliza en libc en FreeBSD 6.2 hasta la versión 7.0-PRERELEASE, permite a atacantes dependientes del contexto provocar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de entradas manipuladas que desencadenan corrupción de memoria. -
CVE Modified by [email protected]
Aug. 20, 2016
Action Type Old Value New Value Added Reference http://marc.info/?l=bugtraq&m=145408644227561&w=2 -
Initial Analysis by [email protected]
Jan. 16, 2008
Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2008-0122 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2008-0122
weaknesses.
Exploit Prediction
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.
1.60 }} 0.06%
score
0.87462
percentile
CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability