CVE-2010-2891

EPSS 14.0%

Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an Object Identifier (aka OID) represented as a numerical string containing many components separated by . (dot) characters.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/15293unverified exploitdbwww.exploit-db.com/exploits/15293unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/41841 http://secunia.com/advisories/42877 http://secunia.com/advisories/42902 http://secunia.com/advisories/43068 http://security-tracker.debian.org/tracker/CVE-2010-2891 https://exchange.xforce.ibmcloud.com/vulnerabilities/62686 http://www.coresecurity.com/content/libsmi-smigetnode-buffer-overflow http://www.debian.org/security/2011/dsa-2145 http://www.exploit-db.com/exploits/15293 http://www.mandriva.com/security/advisories?name=MDVSA-2010:209