CVE-2008-1215: Buffer Overflow

Published Mar 9, 2008

Updated

Stack-based buffer overflow in the commandExpandInterpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters.

Affected Software

5 affected components

FreeBSD FreeBSD=6.3

FreeBSD FreeBSD=7.0

NetBSD NetBSD

OpenBSD OpenBSD=4.1

OpenBSD OpenBSD=4.2

Event History

Mar 9, 2008

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1215?

CVE-2008-1215 has a high severity rating due to the potential for local users to gain elevated privileges.

How do I fix CVE-2008-1215?

To fix CVE-2008-1215, users should apply the appropriate patches or updates provided by their operating system's maintainers.

Which operating systems are affected by CVE-2008-1215?

CVE-2008-1215 affects FreeBSD versions 6.3 and 7.0, OpenBSD versions 4.1 and 4.2, and NetBSD.

What causes the vulnerability in CVE-2008-1215?

The vulnerability in CVE-2008-1215 is caused by a stack-based buffer overflow in the command_Expand_Interpret function.

Can CVE-2008-1215 be exploited remotely?

No, CVE-2008-1215 is a local vulnerability that can only be exploited by local users with access to the affected systems.