Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-4395 | First vendor Publication | 2008-11-06 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 8.3 | Attack Range | Adjacent network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 6.5 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple buffer overflows in the ndiswrapper module 1.53 for the Linux kernel 2.6 allow remote attackers to execute arbitrary code by sending packets over a local wireless network that specify long ESSIDs. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4395 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13632 | |||
| Oval ID: | oval:org.mitre.oval:def:13632 | ||
| Title: | DSA-1731-1 ndiswrapper -- buffer overflow | ||
| Description: | Anders Kaseorg discovered that ndiswrapper suffers from buffer overflows via specially crafted wireless network traffic, due to incorrectly handling long ESSIDs. This could lead to the execution of arbitrary code. For the oldstable distribution, this problem has been fixed in version 1.28-1+etch1. For the stable distribution, this problem has been fixed in version 1.53-2, which was already included in the lenny release. For the testing distribution and the unstable distribution , this problem has been fixed in version 1.53-2. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1731-1 CVE-2008-4395 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ndiswrapper |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17633 | |||
| Oval ID: | oval:org.mitre.oval:def:17633 | ||
| Title: | USN-662-2 -- linux-ubuntu-modules-2.6.22/24 vulnerability | ||
| Description: | USN-662-1 fixed vulnerabilities in ndiswrapper in Ubuntu 8.10. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-662-2 CVE-2008-4395 | Version: | 7 |
| Platform(s): | Ubuntu 7.10 Ubuntu 8.04 | Product(s): | linux-ubuntu-modules-2.6.22 linux-ubuntu-modules-2.6.24 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17666 | |||
| Oval ID: | oval:org.mitre.oval:def:17666 | ||
| Title: | USN-662-1 -- linux vulnerability | ||
| Description: | It was discovered that the Linux kernel could be made to hang temporarily when mounting corrupted ext2/3 filesystems. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-662-1 CVE-2008-3528 CVE-2008-4395 | Version: | 7 |
| Platform(s): | Ubuntu 8.10 | Product(s): | linux |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8321 | |||
| Oval ID: | oval:org.mitre.oval:def:8321 | ||
| Title: | DSA-1731 ndiswrapper -- buffer overflow | ||
| Description: | Anders Kaseorg discovered that ndiswrapper suffers from buffer overflows via specially crafted wireless network traffic, due to incorrectly handling long ESSIDs. This could lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1731 CVE-2008-4395 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ndiswrapper |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for ndiswrapper File : nvt/sles9p5039260.nasl |
| 2009-03-23 | Name : Ubuntu Update for linux vulnerability USN-662-1 File : nvt/gb_ubuntu_USN_662_1.nasl |
| 2009-03-23 | Name : Ubuntu Update for linux-ubuntu-modules-2.6.22/24 vulnerability USN-662-2 File : nvt/gb_ubuntu_USN_662_2.nasl |
| 2009-03-07 | Name : Debian Security Advisory DSA 1731-1 (ndiswrapper) File : nvt/deb_1731_1.nasl |
| 2009-01-13 | Name : Gentoo Security Advisory GLSA 200901-01 (ndiswrapper) File : nvt/glsa_200901_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 49726 | Linux Kernel ndiswrapper Module ESSID Handling Multiple Remote Overflows |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_ndiswrapper-5834.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12315.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_ndiswrapper-081107.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-662-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-662-2.nasl - Type : ACT_GATHER_INFO |
| 2009-03-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1731.nasl - Type : ACT_GATHER_INFO |
| 2009-01-12 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200901-01.nasl - Type : ACT_GATHER_INFO |
| 2008-12-05 | Name : The remote openSUSE host is missing a security update. File : suse_ndiswrapper-5833.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:13:04 |
|
| 2024-11-28 12:16:39 |
|
| 2023-11-07 21:47:48 |
|
| 2021-05-04 12:08:08 |
|
| 2021-04-22 01:08:29 |
|
| 2020-05-23 00:22:21 |
|
| 2017-08-08 09:24:25 |
|
| 2016-04-26 17:53:00 |
|
| 2014-02-17 10:46:50 |
|
| 2013-05-11 00:27:40 |
|
