CVE-2008-1685

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999)

** DISPUTED ** gcc de 4.2.0 a 4.3.0 en GNU Compiler Collection, cuando casts no están utilizados, considera que la suma de un puntero y un entero es mayor o igual que el puntero, lo que podría llevar a la eliminación del código de comprobación de longitud que estaba previsto como un mecanismo de protección contra ataques de desbordamientos de enteros y desbordamiento de búfer, y no proporcionar un mensaje diagnóstico sobre esta eliminación. NOTA: el proveedor ha determinado que este comportamiento del compilador es correcto según la sección 6.5.6 de la norma C99 (también conocido como ISO/IEC 9899:1999).

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-04-06 CVE Reserved
2008-04-06 CVE Published
2024-08-07 CVE Updated
2024-09-08 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-189: Numeric Errors

CAPEC

References (3)

URL	Tag	Source
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26763	X_refsource_misc
http://www.kb.cert.org/vuls/id/162289	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41686	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Gcc Search vendor "Gnu" for product "Gcc"				4.2.0 Search vendor "Gnu" for product "Gcc" and version "4.2.0"		-		Affected
Gnu Search vendor "Gnu"		Gcc Search vendor "Gnu" for product "Gcc"				4.2.1 Search vendor "Gnu" for product "Gcc" and version "4.2.1"		-		Affected
Gnu Search vendor "Gnu"		Gcc Search vendor "Gnu" for product "Gcc"				4.2.2 Search vendor "Gnu" for product "Gcc" and version "4.2.2"		-		Affected
Gnu Search vendor "Gnu"		Gcc Search vendor "Gnu" for product "Gcc"				4.2.3 Search vendor "Gnu" for product "Gcc" and version "4.2.3"		-		Affected
Gnu Search vendor "Gnu"		Gcc Search vendor "Gnu" for product "Gcc"				4.2.4 Search vendor "Gnu" for product "Gcc" and version "4.2.4"		-		Affected
Gnu Search vendor "Gnu"		Gcc Search vendor "Gnu" for product "Gcc"				4.3.0 Search vendor "Gnu" for product "Gcc" and version "4.3.0"		-		Affected