CWE Code: 119
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Improper Restriction of Operations within the Bounds of a Memory Buffer
Summary: heap-based buffer overflow in the strip_escapes function in signal.c in gnu ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename.  note: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component. http://xforce.iss.net/xforce/xfdb/44643

"gnu ed is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the strip_escapes() function. by persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system."
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2008-09-04
Last Modified Date: 2018-10-11
You are a cybersecurity expert assistant. Provide detailed information about vulnerabilities in a clear and structured format.
system
Please provide details about this vulnerability:  Improper Restriction of Operations within the Bounds of a Memory Buffer.
user
CWE Code: 119
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Improper Restriction of Operations within the Bounds of a Memory Buffer
Summary: heap-based buffer overflow in the strip_escapes function in signal.c in gnu ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename.  note: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component. http://xforce.iss.net/xforce/xfdb/44643

"gnu ed is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the strip_escapes() function. by persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system."
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2008-09-04
Last Modified Date: 2018-10-11
assistant