A vulnerability was found in gdam123 0.933/0.942. It has been classified as critical. This affects some unknown functionality. The manipulation of the argument filename with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow in gdam123 0.933 and 0.942 allows local users to execute arbitrary code via a long filename parameter.

The weakness was published 12/31/2002 by Security Team with Netric Security (Website). It is possible to read the advisory at securityfocus.com. This vulnerability is uniquely identified as CVE-2002-1812 since 06/29/2005. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. Technical details and a public exploit are known.

A public exploit has been developed in ANSI C. The exploit is shared for download at securityfocus.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (9991), Exploit-DB (21760) and SecurityFocus (BID 5578†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• gdam123

Version

• 0.933
• 0.942

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion