CVE-2004-0398 Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbi...
HighCVSS 7.5
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webdav cadaver | < 0.22.0 | 0.22.0 |
| webdav neon | <= 0.24.5 | No fix listed |
| debian linux | = 3.0 | No fix listed |
| debian/cadaver(Debian:12) | < 0.22.1-3 | 0.22.1-3 |
| debian/cadaver(Debian:13) | < 0.22.1-3 | 0.22.1-3 |
| debian/cadaver(Debian:14) | < 0.22.1-3 | 0.22.1-3 |
References
- 20040519 Advisory 06/2004: libneon date parsing vulnerability broken-link mailing-list
- CLA-2004:841 broken-link vendor-advisory
- 20040519 Advisory 06/2004: libneon date parsing vulnerability mailing-list third-party-advisory
- 20040519 [OpenPKG-SA-2004.024] OpenPKG Security Advisory (neon) mailing-list third-party-advisory
- 11638 third-party-advisory
- 11650 third-party-advisory
- 11673 third-party-advisory
- GLSA-200405-13 third-party-advisory vendor-advisory
- GLSA-200405-15 third-party-advisory vendor-advisory
- O-148 broken-link government-resource third-party-advisory
- DSA-506 third-party-advisory vendor-advisory
- DSA-507 third-party-advisory vendor-advisory
- MDKSA-2004:049 third-party-advisory vendor-advisory
- 6302 broken-link vdb-entry
- RHSA-2004:191 third-party-advisory vendor-advisory
- 10385 third-party-advisory vdb-entry
- FEDORA-2004-1552 broken-link vendor-advisory
- neon-library-nerfc1036parse-bo(16192) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2004-0398 vendor-advisory