CVE-2008-5403
Trillian AIM Plugin Malformed XML Tag Heap Overflow Vulnerability
Severity Score
10.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Heap-based buffer overflow in the XML parser in the AIM plugin in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a malformed XML tag.
Desbordamiento de búfer basado en montículo en el analizador XML en el plugin AIM en Trillian versiones anteriores a 3.1.12.0, que permite a los atacantes remotos ejecutar arbitrariamente código a través de etiquetas XML mal formadas.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cerulean Studios Trillian. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the XML processing code for Trillian. When parsing a malformed XML tag, the application does not allocate enough space for it's contents. During copying of this to the newly allocated buffer, the application will overwrite heap structures with attacker-supplied data that can then be leveraged to achieve code execution with the privileges of the application.
*Credits:
Damian Put
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2008-12-04 CVE Published
- 2008-12-08 CVE Reserved
- 2023-06-09 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/50474 | Vdb Entry | |
| http://securityreason.com/securityalert/4702 | Third Party Advisory | |
| http://www.securityfocus.com/archive/1/498936/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/32645 | Vdb Entry | |
| http://www.securitytracker.com/id?1021336 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2008/3348 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-08-079 | X_refsource_misc |
|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/47100 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://blog.ceruleanstudios.com/?p=404 | 2018-10-11 | |
| http://secunia.com/advisories/33001 | 2018-10-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.50 Search vendor "Cerulean Studios" for product "Trillian" and version "0.50" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.52 Search vendor "Cerulean Studios" for product "Trillian" and version "0.52" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.60 Search vendor "Cerulean Studios" for product "Trillian" and version "0.60" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.61 Search vendor "Cerulean Studios" for product "Trillian" and version "0.61" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.62 Search vendor "Cerulean Studios" for product "Trillian" and version "0.62" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.63 Search vendor "Cerulean Studios" for product "Trillian" and version "0.63" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.70 Search vendor "Cerulean Studios" for product "Trillian" and version "0.70" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.71 Search vendor "Cerulean Studios" for product "Trillian" and version "0.71" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.72 Search vendor "Cerulean Studios" for product "Trillian" and version "0.72" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.73 Search vendor "Cerulean Studios" for product "Trillian" and version "0.73" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.74 Search vendor "Cerulean Studios" for product "Trillian" and version "0.74" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.74c Search vendor "Cerulean Studios" for product "Trillian" and version "0.74c" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.74d Search vendor "Cerulean Studios" for product "Trillian" and version "0.74d" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.74e Search vendor "Cerulean Studios" for product "Trillian" and version "0.74e" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.74f Search vendor "Cerulean Studios" for product "Trillian" and version "0.74f" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.74g Search vendor "Cerulean Studios" for product "Trillian" and version "0.74g" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.74i Search vendor "Cerulean Studios" for product "Trillian" and version "0.74i" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.635 Search vendor "Cerulean Studios" for product "Trillian" and version "0.635" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.725 Search vendor "Cerulean Studios" for product "Trillian" and version "0.725" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 0.6351 Search vendor "Cerulean Studios" for product "Trillian" and version "0.6351" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 1.0 Search vendor "Cerulean Studios" for product "Trillian" and version "1.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 1.0 Search vendor "Cerulean Studios" for product "Trillian" and version "1.0" | pro |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 2.0 Search vendor "Cerulean Studios" for product "Trillian" and version "2.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 2.0 Search vendor "Cerulean Studios" for product "Trillian" and version "2.0" | pro |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 2.1 Search vendor "Cerulean Studios" for product "Trillian" and version "2.1" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.0" | basic |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.0" | pro |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1" | basic |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1" | pro |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.0.120 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.0.120" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.0.121 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.0.121" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.5.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.5.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.5.1 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.5.1" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.6.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.6.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.7.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.7.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.8.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.8.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.9.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.9.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.9.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.9.0" | basic |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.9.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.9.0" | pro |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.10.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.10.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Search vendor "Cerulean Studios" for product "Trillian" | 3.1.11.0 Search vendor "Cerulean Studios" for product "Trillian" and version "3.1.11.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Pro Search vendor "Cerulean Studios" for product "Trillian Pro" | * | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Pro Search vendor "Cerulean Studios" for product "Trillian Pro" | 1.0 Search vendor "Cerulean Studios" for product "Trillian Pro" and version "1.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Pro Search vendor "Cerulean Studios" for product "Trillian Pro" | 2.0 Search vendor "Cerulean Studios" for product "Trillian Pro" and version "2.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Pro Search vendor "Cerulean Studios" for product "Trillian Pro" | 2.01 Search vendor "Cerulean Studios" for product "Trillian Pro" and version "2.01" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Pro Search vendor "Cerulean Studios" for product "Trillian Pro" | 3.0 Search vendor "Cerulean Studios" for product "Trillian Pro" and version "3.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Pro Search vendor "Cerulean Studios" for product "Trillian Pro" | 3.1.5.0 Search vendor "Cerulean Studios" for product "Trillian Pro" and version "3.1.5.0" | - |
Affected
| ||||||
| Cerulean Studios Search vendor "Cerulean Studios" | Trillian Pro Search vendor "Cerulean Studios" for product "Trillian Pro" | 3.1_build_121 Search vendor "Cerulean Studios" for product "Trillian Pro" and version "3.1_build_121" | - |
Affected
| ||||||
| Ceruleanstudios Search vendor "Ceruleanstudios" | Trillian Search vendor "Ceruleanstudios" for product "Trillian" | * | - |
Affected
| ||||||
| Ceruleanstudios Search vendor "Ceruleanstudios" | Trillian Search vendor "Ceruleanstudios" for product "Trillian" | 3.1.0.9 Search vendor "Ceruleanstudios" for product "Trillian" and version "3.1.0.9" | - |
Affected
| ||||||
| Ceruleanstudios Search vendor "Ceruleanstudios" | Trillian Search vendor "Ceruleanstudios" for product "Trillian" | 3.1.9.0 Search vendor "Ceruleanstudios" for product "Trillian" and version "3.1.9.0" | - |
Affected
| ||||||
| Ceruleanstudios Search vendor "Ceruleanstudios" | Trillian Pro Search vendor "Ceruleanstudios" for product "Trillian Pro" | * | - |
Affected
| ||||||
| Ceruleanstudios Search vendor "Ceruleanstudios" | Trillian Pro Search vendor "Ceruleanstudios" for product "Trillian Pro" | 3.1.9.0 Search vendor "Ceruleanstudios" for product "Trillian Pro" and version "3.1.9.0" | - |
Affected
| ||||||