« Volver al listado

CVE-2008-6903

Estado: ModificadaMedia (4.3)—

Sophos Anti-Virus for Windows before 7.6.3, Anti-Virus for Windows NT/9x before 4.7.18, Anti-Virus for OS X before 4.9.18, Anti-Virus for Linux before 6.4.5, Anti-Virus for UNIX before 7.0.5, Anti-Virus for Unix and Netware before 4.37.0, Sophos EM Library, and Sophos small business solutions, when CAB archive scanning is enabled, allows remote attackers to cause a denial of service (segmentation fault) via a "fuzzed" CAB archive file, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Sophos — Anti-virusSophos — Anti-virus7.6.3

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-6903",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-06T00:30:00.297",
  "references": [
    {
      "url": "http://marc.info/?l=bugtraq&m=122893252316489&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/50863",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/33177",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ivizsecurity.com/security-advisory-iviz-sr-08015.html",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/32748",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1021476",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.sophos.com/support/knowledgebase/article/50611.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/3458",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=122893252316489&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/50863",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/33177",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ivizsecurity.com/security-advisory-iviz-sr-08015.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/32748",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1021476",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.sophos.com/support/knowledgebase/article/50611.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/3458",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sophos Anti-Virus for Windows before 7.6.3, Anti-Virus for Windows NT/9x before 4.7.18, Anti-Virus for OS X before 4.9.18, Anti-Virus for Linux before 6.4.5, Anti-Virus for UNIX before 7.0.5, Anti-Virus for Unix and Netware before 4.37.0, Sophos EM Library, and Sophos small business solutions, when CAB archive scanning is enabled, allows remote attackers to cause a denial of service (segmentation fault) via a \"fuzzed\" CAB archive file, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats."
    },
    {
      "lang": "es",
      "value": "Sophos Anti-Virus para Windows anteriores a v7.6.3, Anti-Virus para Windows NT/9x anteriores a v.4.7.18, Anti-Virus para OS X anteriores a v.4.9.18, Anti-Virus para Linux anteriores a v.6.4.5, Anti-Virus para UNIX anteriores a v7.0.5, Anti-Virus para Unix y Netware anteriores a v.4.37.0, Sophos EM Library, y Sophos small business solutions, cuando el archivo escaneado CAB está activo, permite a atacantes remotos causar una denegación de servicio (falta de segmentación) a través del fichero \"fuzzed\" CAB, como se ha demostrado mediante la suite para el testeo de formatos de archivo PROTOS GENOME."
    }
  ],
  "lastModified": "2026-06-16T23:03:12.227",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sophos:anti-virus:4.7.18:*:windows-nt:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1BEF5DD-8418-4C76-9351-ACD3ED25236E"
            },
            {
              "criteria": "cpe:2.3:a:sophos:anti-virus:4.7.18:*:windows_9x:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A15CB3E6-A97F-491B-B27E-E4AF255E0088"
            },
            {
              "criteria": "cpe:2.3:a:sophos:anti-virus:4.9.18:*:os_x:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E61D3204-DE1E-489E-9624-DD02F1B58F95"
            },
            {
              "criteria": "cpe:2.3:a:sophos:anti-virus:4.37.0:*:netware:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77FF9B2E-2A38-4A13-AA20-83081A5D9AF4"
            },
            {
              "criteria": "cpe:2.3:a:sophos:anti-virus:6.4.5:*:linux:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "550B1595-4C9F-412C-B903-DDD8202C1F4F"
            },
            {
              "criteria": "cpe:2.3:a:sophos:anti-virus:7.0.5:*:unix:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52F3B857-84EC-4FB8-A332-B7B81BCEB28C"
            },
            {
              "criteria": "cpe:2.3:a:sophos:anti-virus7.6.3:*:windows:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98EFEFC0-92AC-43A6-A072-B6AD2D4B0984"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}