Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via (1) a long argument on the command line; a long (2) WNSEARCHDIR, (3) WNHOME, or (4) WNDBVERSION environment variable; or (5) a user-supplied dictionary (aka data file). NOTE: since WordNet itself does not run with special privileges, this issue only crosses privilege boundaries when WordNet is invoked as a third party component.

The version of wordnet installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2008-3908 advisory.

  - Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute     arbitrary code via (1) a long argument on the command line; a long (2) WNSEARCHDIR, (3) WNHOME, or (4)     WNDBVERSION environment variable; or (5) a user-supplied dictionary (aka data file). NOTE: since WordNet     itself does not run with special privileges, this issue only crosses privilege boundaries when WordNet is     invoked as a third party component. (CVE-2008-3908)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Rob Holland found several programming errors in WordNet which could lead to the execution or arbitrary code when used with untrusted input (CVE-2008-2149, CVE-2008-3908).

Update :

The previous patch had a typo that caused incorrect behaviour in WordNet. This update uses an update patch that corrects the issue and also notes the additional assigned CVE name for these issues.

The remote host is affected by the vulnerability described in GLSA-200810-01 (WordNet: Execution of arbitrary code)

    Jukka Ruohonen initially reported a boundary error within the     searchwn() function in src/wn.c. A thorough investigation by the oCERT     team revealed several other vulnerabilities in WordNet:
    Jukka Ruohonen and Rob Holland (oCERT) reported multiple boundary     errors within the searchwn() function in src/wn.c, the wngrep()     function in lib/search.c, the morphstr() and morphword() functions in     lib/morph.c, and the getindex() in lib/search.c, which lead to     stack-based buffer overflows.
    Rob Holland (oCERT) reported two     boundary errors within the do_init() function in lib/morph.c, which     lead to stack-based buffer overflows via specially crafted     'WNSEARCHDIR' or 'WNHOME' environment variables.
    Rob Holland     (oCERT) reported multiple boundary errors in the bin_search() and     bin_search_key() functions in binsrch.c, which lead to stack-based     buffer overflows via specially crafted data files.
    Rob Holland     (oCERT) reported a boundary error within the parse_index() function in     lib/search.c, which leads to a heap-based buffer overflow via specially     crafted data files.
  Impact :

    In case the application is accessible e.g. via a web server,     a remote attacker could pass overly long strings as arguments to the     'wm' binary, possibly leading to the execution of arbitrary code.
    A local attacker could exploit the second vulnerability via     specially crafted 'WNSEARCHDIR' or 'WNHOME' environment variables,     possibly leading to the execution of arbitrary code with escalated     privileges.
    A local attacker could exploit the third and     fourth vulnerability by making the application use specially crafted     data files, possibly leading to the execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

Rob Holland discovered several programming errors in WordNet, an electronic lexical database of the English language. These flaws could allow arbitrary code execution when used with untrusted input, for example when WordNet is in use as a back end for a web application.

ID	Name	Product	Family	Severity
201732	CBL Mariner 2.0 Security Update: wordnet (CVE-2008-3908)	Nessus	MarinerOS Local Security Checks	critical
36999	Mandriva Linux Security Advisory : wordnet (MDVSA-2008:182-1)	Nessus	Mandriva Local Security Checks	critical
34365	GLSA-200810-01 : WordNet: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
34088	Debian DSA-1634-1 : wordnet - stack and heap overflows	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2008-3908

critical

Tenable Plugins

critical

critical

critical

critical