Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code via a long URL in t…

Exploit prediction (EPSS)

7.81% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

• EDB-6238 IntelliTamper 2.07/2.08 Beta 4 - A HREF Remote Buffer Overflow · remote · 2008-08-13
• EDB-6121 IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow · remote · 2008-07-23
• EDB-6116 IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow · remote · 2008-07-22
• EDB-6103 IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow (PoC) · dos · 2008-07-21

CVSS scores

Classification

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

• exploit-db.com /exploits/6238 · exploit, x_refsource_EXPLOIT-DB, x_transferred
• exploit-db.com /exploits/6103 · exploit, x_refsource_EXPLOIT-DB, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/43876 · vdb-entry, x_refsource_XF, x_transferred
• exploit-db.com /exploits/6116 · exploit, x_refsource_EXPLOIT-DB, x_transferred
• securitytracker.com /id?1020521 · vdb-entry, x_refsource_SECTRACK, x_transferred
• securityreason.com /securityalert/4058 · third-party-advisory, x_refsource_SREASON, x_transferred
• vupen.com /english/advisories/2008/2120/references · vdb-entry, x_refsource_VUPEN, x_transferred
• securityfocus.com /bid/30317 · vdb-entry, x_refsource_BID, x_transferred
• exploit-db.com /exploits/6121 · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

• CVE List: CVE-2008-3360
• NVD: CVE-2008-3360

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.