FKIE_CVE-2008-5177

Vulnerability from fkie_nvd - Published: 2008-11-20 15:30 - Updated: 2026-06-16 22:59
Severity
Summary
Stack-based buffer overflow in the DtbClsLogin function in Yosemite Backup 8.7 allows remote attackers to (1) execute arbitrary code on a Linux platform, related to libytlindtb.so; or (2) cause a denial of service (application crash) and possibly execute arbitrary code on a Windows platform, related to ytwindtb.dll; via a long username field during authentication.
References
cve@mitre.orghttp://osvdb.org/49743
cve@mitre.orghttp://osvdb.org/49744
cve@mitre.orghttp://secunia.com/advisories/32262Vendor Advisory
cve@mitre.orghttp://www.insight-tech.org/index.php?p=Yosemite-backup-8-7-DtbClsLogin-Buffer-Overflow-VulnerabilityExploit, Vendor Advisory, URL Repurposed
cve@mitre.orghttp://www.insight-tech.org/xploits/yosemiteStackOverflowExploit.zipExploit, URL Repurposed
cve@mitre.orghttp://www.securityfocus.com/bid/32246
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/46515
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/49743
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/49744
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32262Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.insight-tech.org/index.php?p=Yosemite-backup-8-7-DtbClsLogin-Buffer-Overflow-VulnerabilityExploit, Vendor Advisory, URL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://www.insight-tech.org/xploits/yosemiteStackOverflowExploit.zipExploit, URL Repurposed
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/32246
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/46515
Impacted products
Vendor Product Version
insight-tech yosemite_backup 8.7
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:insight-tech:yosemite_backup:8.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "64DFEFC8-F6B1-471A-BBBB-3F4C8C0E6E7B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the DtbClsLogin function in Yosemite Backup 8.7 allows remote attackers to (1) execute arbitrary code on a Linux platform, related to libytlindtb.so; or (2) cause a denial of service (application crash) and possibly execute arbitrary code on a Windows platform, related to ytwindtb.dll; via a long username field during authentication."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n DtbClsLogin en Yosemite Backup v8.7 que permite a atacantes remotos (1) ejecutar c\u00f3digo a su elecci\u00f3n desde una plataforma Linux, relacionado con libytlindtb.so; o (2) producir una denegacion de servicio (ca\u00edda de aplicaci\u00f3n) y posiblemente una ejecuci\u00f3n de c\u00f3digo a elecci\u00f3n del atacante a trav\u00e9s de una plataforma Windows, relacionado con ytwindtb.dll; a trav\u00e9s del campo de nombre usuario largo durante la autenticaci\u00f3n."
    }
  ],
  "evaluatorImpact": "http://www.insight-tech.org/index.php?p=Yosemite-backup-8-7-DtbClsLogin-Buffer-Overflow-Vulnerability\r\n\r\n\"There exists a vulnerability within a function in Yosemite Backup 8.7 which leads to remote compromise of the vulnerable system if properly exploited.\r\nThe vulnerability affects both Linux/Windows versions of Yosemite Backup 8.7.\"",
  "id": "CVE-2008-5177",
  "lastModified": "2026-06-16T22:59:24.183",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-11-20T15:30:00.313",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/49743"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/49744"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32262"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Vendor Advisory",
        "URL Repurposed"
      ],
      "url": "http://www.insight-tech.org/index.php?p=Yosemite-backup-8-7-DtbClsLogin-Buffer-Overflow-Vulnerability"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "url": "http://www.insight-tech.org/xploits/yosemiteStackOverflowExploit.zip"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/32246"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46515"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/49743"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/49744"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32262"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory",
        "URL Repurposed"
      ],
      "url": "http://www.insight-tech.org/index.php?p=Yosemite-backup-8-7-DtbClsLogin-Buffer-Overflow-Vulnerability"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "url": "http://www.insight-tech.org/xploits/yosemiteStackOverflowExploit.zip"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/32246"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46515"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.