vulnwire
7.5high

CVE-2007-5360in critical feed

Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined, as used in VMW…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
15.3%
percentile 97%
Public exploits
0
none known

Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined, as used in VMWare ESX Server 3.0.1 and 3.0.2, might allow remote attackers to execute arbitrary code via vectors related to PAM authentication, a different vulnerability than CVE-2008-0003.

Exploit prediction (EPSS)

15.33% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • securityreason.com /securityalert/3538 · third-party-advisory, x_refsource_SREASON, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/39524 · vdb-entry, x_refsource_XF, x_transferred
  • novell.com /linux/security/advisories/suse_security_summary_report.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • secunia.com /advisories/29986 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c01438409 · vendor-advisory, x_refsource_HP, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2007-5360 · x_refsource_MISC, x_transferred
  • securityfocus.com /archive/1/485936/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • attrition.org /pipermail/vim/2008-January/001879.html · mailing-list, x_refsource_VIM, x_transferred
  • vupen.com /english/advisories/2008/0063 · vdb-entry, x_refsource_VUPEN, x_transferred
  • lists.vmware.com /pipermail/security-announce/2008/000002.html · mailing-list, x_refsource_MLIST, x_transferred
  • secunia.com /advisories/28368 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/1391/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/28636 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28358 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vmware.com /security/advisories/VMSA-2008-0001.html · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2008/0064 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/486859/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.