Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-0585 | First vendor Publication | 2009-03-14 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0585 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13555 | |||
| Oval ID: | oval:org.mitre.oval:def:13555 | ||
| Title: | USN-737-1 -- libsoup vulnerability | ||
| Description: | It was discovered that the Base64 encoding functions in libsoup did not properly handle large strings. If a user were tricked into connecting to a malicious server, an attacker could possibly execute arbitrary code with user privileges. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-737-1 CVE-2009-0585 | Version: | 5 |
| Platform(s): | Ubuntu 7.10 Ubuntu 6.06 | Product(s): | libsoup |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13600 | |||
| Oval ID: | oval:org.mitre.oval:def:13600 | ||
| Title: | DSA-1748-1 libsoup -- integer overflow | ||
| Description: | It was discovered that libsoup, an HTTP library implementation in C, handles large strings insecurely via its Base64 encoding functions. This could possibly lead to the execution of arbitrary code. For the oldstable distribution, this problem has been fixed in version 2.2.98-2+etch1. The stable distribution is not affected by this issue. The testing distribution and the unstable distribution are not affected by this issue. We recommend that you upgrade your libsoup packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1748-1 CVE-2009-0585 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libsoup |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22790 | |||
| Oval ID: | oval:org.mitre.oval:def:22790 | ||
| Title: | ELSA-2009:0344: libsoup security update (Moderate) | ||
| Description: | Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:0344-01 CVE-2009-0585 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | evolution28-libsoup libsoup |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29371 | |||
| Oval ID: | oval:org.mitre.oval:def:29371 | ||
| Title: | RHSA-2009:0344 -- libsoup security update (Moderate) | ||
| Description: | Updated libsoup and evolution28-libsoup packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libsoup is an HTTP client/library implementation for GNOME written in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:0344 CVE-2009-0585 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 | Product(s): | evolution28-libsoup libsoup |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:8391 | |||
| Oval ID: | oval:org.mitre.oval:def:8391 | ||
| Title: | DSA-1748 libsoup -- integer overflow | ||
| Description: | It was discovered that libsoup, an HTTP library implementation in C, handles large strings insecurely via its Base64 encoding functions. This could possibly lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1748 CVE-2009-0585 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libsoup |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9599 | |||
| Oval ID: | oval:org.mitre.oval:def:9599 | ||
| Title: | Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation. | ||
| Description: | Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-0585 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 5 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for evolution28-libsoup CESA-2009:0344 centos4 i386 File : nvt/gb_CESA-2009_0344_evolution28-libsoup_centos4_i386.nasl |
| 2009-10-13 | Name : SLES10: Security update for libsoup File : nvt/sles10_libsoup.nasl |
| 2009-10-10 | Name : SLES9: Security update for libsoup File : nvt/sles9p5048922.nasl |
| 2009-05-25 | Name : CentOS Security Advisory CESA-2009:0344 (libsoup) File : nvt/ovcesa2009_0344.nasl |
| 2009-05-20 | Name : SuSE Security Summary SUSE-SR:2009:010 File : nvt/suse_sr_2009_010.nasl |
| 2009-04-06 | Name : Mandrake Security Advisory MDVSA-2009:081 (libsoup) File : nvt/mdksa_2009_081.nasl |
| 2009-03-31 | Name : Debian Security Advisory DSA 1748-1 (libsoup) File : nvt/deb_1748_1.nasl |
| 2009-03-20 | Name : RedHat Security Advisory RHSA-2009:0344 File : nvt/RHSA_2009_0344.nasl |
| 2009-03-20 | Name : Ubuntu USN-735-1 (gst-plugins-base0.10) File : nvt/ubuntu_735_1.nasl |
| 2009-03-20 | Name : Ubuntu USN-736-1 (gst-plugins-good0.10) File : nvt/ubuntu_736_1.nasl |
| 2009-03-20 | Name : Ubuntu USN-737-1 (libsoup) File : nvt/ubuntu_737_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 52961 | libsoup soup-misc.c soup_base64_encode() Function Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0344.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090316_libsoup_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12411.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libsoup-6223.nasl - Type : ACT_GATHER_INFO |
| 2009-05-26 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0344.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-081.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-737-1.nasl - Type : ACT_GATHER_INFO |
| 2009-03-22 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1748.nasl - Type : ACT_GATHER_INFO |
| 2009-03-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0344.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:11:54 |
|
| 2024-11-28 12:18:18 |
|
| 2023-02-13 09:29:20 |
|
| 2023-02-02 17:28:14 |
|
| 2021-05-04 12:09:09 |
|
| 2021-04-22 01:09:29 |
|
| 2020-05-23 00:23:22 |
|
| 2018-10-11 00:19:30 |
|
| 2017-09-29 09:24:04 |
|
| 2017-08-17 09:22:27 |
|
| 2016-04-26 18:38:28 |
|
| 2014-02-17 10:48:51 |
|
| 2013-05-10 23:44:28 |
|
