Vulnerability CVE-2009-0323 - CERT Civis.Net

Vulnerability Name:

CVE-2009-0323 (CCN-48325)

Assigned:

2009-01-28

Published:

2009-01-28

Updated:

2018-10-11

Summary:

Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an "HTML GI" in a start tag, which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c, related to the msgBuffer variable.
Note: these are different vectors than CVE-2008-6005.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
8.3 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-0323

Source: CCN
Type: CORE-2008-1211
Amaya web editor XML and HTML parser vulnerabilities

Source: MISC
Type: Exploit
http://www.coresecurity.com/content/amaya-buffer-overflows

Source: BUGTRAQ
Type: UNKNOWN
20090128 CORE-2008-1211: Amaya web editor XML and HTML parser vulnerabilities

Source: CCN
Type: BID-33046
W3C Amaya HTML 'input' Tag Parameter Buffer Overflow Vulnerability

Source: CCN
Type: BID-33047
W3C Amaya Multiple Buffer Overflow Vulnerabilities

Source: CCN
Type: W3C Web site
Amaya Home Page

Source: XF
Type: UNKNOWN
amaya-html-tags-bo(48325)

Source: XF
Type: UNKNOWN
amaya-html-tags-bo(48325)

Source: EXPLOIT-DB
Type: UNKNOWN
7902

Vulnerable Configuration:

Configuration 1:

cpe:/a:w3:amaya:0.9:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:0.95b:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.0a:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.1a:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.1c:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.2a:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.3a:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.3b:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.4:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:1.4a:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:2.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:2.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:2.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:2.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:2.4:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:3.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:3.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:3.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:4.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:4.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:4.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:4.2.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:4.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:4.3.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:4.3.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:5.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:5.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:5.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:5.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:6.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:6.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:6.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:6.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:6.4:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:7.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:7.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:7.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.1a:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.1b:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.4:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.5:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.6:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.7:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.7.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.7.2:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.8.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.8.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.8.4:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.8.5:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:8.52:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.2.1:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.3:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.4:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.5:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.52:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.53:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.54:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:9.55:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:10.0:*:*:*:*:*:*:*

OR cpe:/a:w3:amaya:*:*:*:*:*:*:*:* (Version <= 11.0)

Configuration CCN 1:

cpe:/a:w3c:amaya:9.4:*:*:*:*:*:*:*

Denotes that component is vulnerable