Multiple buffer overflows in cscope 15.5 and earlier allow user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple vectors including (1) a long pathname that is not properly handled during file list parsing, (2) long pathnames that result from path variable expansion such as tilde expansion for the HOME environment variable, and (3) a long -f (aka reffile) command line argument.

From Red Hat Security Advisory 2009:1101 :

An updated cscope package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cscope is a mature, ncurses-based, C source-code tree browsing tool.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2006-4262, CVE-2009-0148, CVE-2009-1577)

All users of cscope are advised to upgrade to this updated package, which contains backported patches to fix these issues. All running instances of cscope must be restarted for this update to take effect.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2006-4262, CVE-2009-0148, CVE-2009-1577)

All running instances of cscope must be restarted for this update to take effect.

An updated cscope package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cscope is a mature, ncurses-based, C source-code tree browsing tool.

Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope.
(CVE-2004-2541, CVE-2006-4262, CVE-2009-0148, CVE-2009-1577)

All users of cscope are advised to upgrade to this updated package, which contains backported patches to fix these issues. All running instances of cscope must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-200610-08 (Cscope: Multiple buffer overflows)

    Unchecked use of strcpy() and *scanf() leads to several buffer     overflows.
  Impact :

    A user could be enticed to open a carefully crafted file which would     allow the attacker to execute arbitrary code with the permissions of     the user running Cscope.
  Workaround :

    There is no known workaround at this time.

Will Drewry of the Google Security Team discovered several buffer overflows in cscope, a source browsing tool, which might lead to the execution of arbitrary code.

Secunia reports :

Will Drewry has reported some vulnerabilities in Cscope, which potentially can be exploited by malicious people to compromise a vulnerable system.

Various boundary errors within the parsing of file lists or the expansion of environment variables can be exploited to cause stack-based buffer overflows when parsing specially crafted 'cscope.lists' files or directories.

A boundary error within the parsing of command line arguments can be exploited to cause a stack-based buffer overflow when supplying an overly long 'reffile' argument.

Successful exploitation may allow execution of arbitrary code.

ID	Name	Product	Family	Severity
67872	Oracle Linux 3 / 4 : cscope (ELSA-2009-1101)	Nessus	Oracle Linux Local Security Checks	high
60595	Scientific Linux Security Update : cscope on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
39424	CentOS 3 : cscope (CESA-2009:1101)	Nessus	CentOS Local Security Checks	high
39412	RHEL 3 / 4 : cscope (RHSA-2009:1101)	Nessus	Red Hat Local Security Checks	high
22894	GLSA-200610-08 : Cscope: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	medium
22728	Debian DSA-1186-1 : cscope - buffer overflows	Nessus	Debian Local Security Checks	medium
22517	FreeBSD : cscope -- Buffer Overflow Vulnerabilities (74ff10f6-520f-11db-8f1a-000a48049292)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-4262

critical

Tenable Plugins

high

high

high

high

medium

medium

medium