CVE Feed

    Dashboard / CVE / CVE-2008-2357

    CVE-2008-2357

    Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record. NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.

    Published:May 19, 2008
    Last Modified:Apr 23, 2026
    EPS:May 21, 2008
    EPSS Score:0.07562
    CVSS Score:6.8

    Affected Products

    Vendor
    Matt Kimball And Roger Wolff
    Product
    Mtr

    Exploits

    http://seclists.org/fulldisclosure/2008/May/0488.htmlhttp://seclists.org/fulldisclosure/2008/May/0488.html

    References

    ftp://ftp.bitwizard.nl/mtr/mtr-0.73.diff
    http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
    http://seclists.org/fulldisclosure/2008/May/0488.html
    http://secunia.com/advisories/30312
    http://secunia.com/advisories/30340
    http://secunia.com/advisories/30359
    http://secunia.com/advisories/30522
    http://secunia.com/advisories/30967
    http://security.gentoo.org/glsa/glsa-200806-01.xml
    http://securityreason.com/securityalert/3903
    http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0175
    http://www.debian.org/security/2008/dsa-1587
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:176
    http://www.openwall.com/lists/oss-security/2008/05/21/1
    http://www.openwall.com/lists/oss-security/2008/05/21/3
    http://www.openwall.com/lists/oss-security/2008/05/21/4
    http://www.securityfocus.com/archive/1/492260/100/0/threaded
    http://www.securityfocus.com/bid/29290
    http://www.securitytracker.com/id?1020046
    https://exchange.xforce.ibmcloud.com/vulnerabilities/42535
    https://issues.rpath.com/browse/RPL-2558
    ftp://ftp.bitwizard.nl/mtr/mtr-0.73.diff
    http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html
    http://seclists.org/fulldisclosure/2008/May/0488.html
    http://secunia.com/advisories/30312
    http://secunia.com/advisories/30340
    http://secunia.com/advisories/30359
    http://secunia.com/advisories/30522
    http://secunia.com/advisories/30967
    http://security.gentoo.org/glsa/glsa-200806-01.xml
    http://securityreason.com/securityalert/3903
    http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0175
    http://www.debian.org/security/2008/dsa-1587
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:176
    http://www.openwall.com/lists/oss-security/2008/05/21/1
    http://www.openwall.com/lists/oss-security/2008/05/21/3
    http://www.openwall.com/lists/oss-security/2008/05/21/4
    http://www.securityfocus.com/archive/1/492260/100/0/threaded
    http://www.securityfocus.com/bid/29290
    http://www.securitytracker.com/id?1020046
    https://exchange.xforce.ibmcloud.com/vulnerabilities/42535
    https://issues.rpath.com/browse/RPL-2558

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High