CVE-2009-1577: Buffer Overflow
A stack-based buffer overflow existed in cscope's putstring function in cscope's versions prior to 15.6. A long function or symbol name in source code file could result in cscope crash or code execution when searching the source code for any function or symbol name.
Issue was originally reported via bug #189666, it can be reproduced using memcheck/tests/match-overrun.c from valgrind source tarball.
In cscope 15.6, putstring was replaced with function fetchstringfromdbase, which accepts target buffer size as its argument.
Upstream commit: http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19
Patch, which was used in Fedora cscope packages and is used in cscope packages in Red Hat Enterprise Linux 5: http://cvs.fedoraproject.org/viewvc/rpms/cscope/devel/cscope-15.5-putstring-overflow.patch
Other sources
Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to execute arbitrary code via a long (1) function name or (2) symbol in a source-code file.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1577?
CVE-2009-1577 has a high severity due to potential remote code execution via stack-based buffer overflows.
How do I fix CVE-2009-1577?
To fix CVE-2009-1577, update Cscope to version 15.6 or later, which addresses the buffer overflow vulnerabilities.
What versions of Cscope are affected by CVE-2009-1577?
CVE-2009-1577 affects Cscope versions prior to 15.6, including 15.0bl2, 15.1, 15.3, 15.4, and 15.5.
What type of attack does CVE-2009-1577 allow?
CVE-2009-1577 allows user-assisted remote attackers to execute arbitrary code by supplying a long function name or symbol.
Who can exploit the vulnerabilities described in CVE-2009-1577?
The vulnerabilities in CVE-2009-1577 can be exploited by remote attackers if a victim is tricked into using a specially crafted source-code file.