CVE-2008-0003

CRITICAL 10.0CVE-2008-0003 · Published 08/01/2008 · updated 16/06/2026

In short

CVE-2008-0003 is a CRITICAL (CVSS 10.0) vulnerability affecting management server (openpegasus).
Chance of exploitation in the next 30 days (EPSS): 7.8%, higher than 94.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
management server openpegasus	`= 2.6.1`	No fix yet

Description

Stack-based buffer overflow in the PAMBasicAuthenticator::PAMCallback function in OpenPegasus CIM management server (tog-pegasus), when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined, might allow remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2007-5360.

References

h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp
lists.vmware.com/pipermail/security-announce/2008/000014.html
osvdb.org/40082
secunia.com/advisories/28338 · Vendor Advisory
secunia.com/advisories/28462 · Vendor Advisory
secunia.com/advisories/29056 · Vendor Advisory
secunia.com/advisories/29785 · Vendor Advisory
secunia.com/advisories/29986 · Vendor Advisory
securitytracker.com/id
attrition.org/pipermail/vim/2008-January/001879.html
redhat.com/support/errata/RHSA-2008-0002.html · Patch
securityfocus.com/archive/1/490917/100/0/threaded
securityfocus.com/bid/27172
securityfocus.com/bid/27188

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free