Unscored severity · published Mar 12, 2008
CVE-2008-1303
The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a missing parameter to the (1)…
–
CVSS
7.6%
EPSS
No
On KEV
Description
The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a missing parameter to the (1) dm-FaultFile, (2) dm-LazyCheck, (3) dm-ResolvedFile, (4) dm-OpenFile, (5) crypto, and possibly unspecified other commands, which triggers a NULL pointer dereference.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Perforce Server · Perforce
through 2007.3_143793; 2000.1; 2000.2; 2001.1; 2001.2; 2002.1; +10 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1303
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1303
aluigi.altervista.org
http://aluigi.altervista.org/adv/perforces-adv.txt
Exploit
http://aluigi.org/poc/perforces.zip
Vendor Advisory
http://secunia.com/advisories/29231
securityreason.com
http://securityreason.com/securityalert/3735
www.securityfocus.com
http://www.securityfocus.com/archive/1/489179/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/28108
More from Perforce Server
–
CVE-2010-0935
Perforce Server 2009.2 and earlier, when the protection table is empty, allows remote authenticated users to obtain super privileges via a "p4 protect" command
–
CVE-2010-0934
The triggers functionality in Perforce Server 2008.1 allows remote authenticated users with super privileges to execute arbitrary operating-system commands by using a "p4 client"…
–
CVE-2010-0933
Directory traversal vulnerability in Perforce Server 2008.1 allows remote authenticated users to create arbitrary files via a
–
CVE-2010-0932
The FTP server in Perforce Server 2008.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain MKD command
–
CVE-2010-0931
The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (daemon crash) via crafted data, possibly involving a large sndbuf…