CVE-2009-0537: Integer Overflow
Integer overflow in the ftsbuild function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the ftslevel structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0537?
CVE-2009-0537 is classified as a denial of service vulnerability due to an integer overflow that can cause application crashes.
How do I fix CVE-2009-0537?
To fix CVE-2009-0537, upgrade to a version of OpenBSD later than 4.4 or apply the appropriate patches provided by the maintainers.
What systems are affected by CVE-2009-0537?
CVE-2009-0537 affects OpenBSD versions up to 4.4 and Microsoft Interix version 6.0 build 10.0.6030.0.
What type of attack can exploit CVE-2009-0537?
Exploit of CVE-2009-0537 can be performed by malicious users creating a deep directory tree structure that causes the application to crash.
Is CVE-2009-0537 considered a zero-day vulnerability?
CVE-2009-0537 is not a zero-day vulnerability as it was publicly disclosed in 2009 and patches or mitigations are available.