CVE-2003-0777: Medium severity SANE SANE vulnerability
saned in sane-backends 1.0.7 and earlier, when debug messages are enabled, does not properly handle dropped connections, which can prevent strings from being null terminated and cause a denial of service (segmentation fault).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable debug messages for saned in sane-backends (do not enable debug logging), because when debug messages are enabled saned in sane-backends 1.0.7 and earlier can fail to properly handle dropped connections leading to non-null-terminated strings and a segmentation fault.
saned (sane-backends) debug messages = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0777?
CVE-2003-0777 has a severity rating that indicates it can lead to a denial of service due to a segmentation fault.
How do I fix CVE-2003-0777?
To fix CVE-2003-0777, you should upgrade to sane-backends version 1.0.9 or later.
What versions of SANE are affected by CVE-2003-0777?
CVE-2003-0777 affects sane-backends versions 1.0.0 through 1.0.8, including several beta versions.
What impact does CVE-2003-0777 have on system functionality?
The impact of CVE-2003-0777 can cause dropped connections that prevent strings from being null-terminated, leading to application crashes.
Is debug mode related to CVE-2003-0777?
Yes, CVE-2003-0777 is triggered when debug messages are enabled in the affected versions of SANE.