FKIE_CVE-2008-5714

Vulnerability from fkie_nvd - Published: 2008-12-24 18:29 - Updated: 2026-06-16 23:00
Severity
Summary
Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended.
References
cve@mitre.orghttp://lists.gnu.org/archive/html/qemu-devel/2008-11/msg01224.html
cve@mitre.orghttp://lists.gnu.org/archive/html/qemu-devel/2008-12/msg00498.html
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
cve@mitre.orghttp://secunia.com/advisories/33568
cve@mitre.orghttp://secunia.com/advisories/34642
cve@mitre.orghttp://secunia.com/advisories/35062
cve@mitre.orghttp://svn.savannah.gnu.org/viewvc/?view=rev&root=qemu&revision=5966
cve@mitre.orghttp://svn.savannah.gnu.org/viewvc/trunk/monitor.c?root=qemu&r1=5966&r2=5965&pathrev=5966
cve@mitre.orghttp://www.securityfocus.com/bid/33020
cve@mitre.orghttp://www.ubuntu.com/usn/usn-776-1
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/47683
af854a3a-2127-422b-91ae-364da2661108http://lists.gnu.org/archive/html/qemu-devel/2008-11/msg01224.html
af854a3a-2127-422b-91ae-364da2661108http://lists.gnu.org/archive/html/qemu-devel/2008-12/msg00498.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33568
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34642
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35062
af854a3a-2127-422b-91ae-364da2661108http://svn.savannah.gnu.org/viewvc/?view=rev&root=qemu&revision=5966
af854a3a-2127-422b-91ae-364da2661108http://svn.savannah.gnu.org/viewvc/trunk/monitor.c?root=qemu&r1=5966&r2=5965&pathrev=5966
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/33020
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/usn-776-1
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/47683
Impacted products
Vendor Product Version
qemu qemu 0.9.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6205775B-4A83-498F-A60E-54473F5D5704",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Off-by-one error in monitor.c in Qemu 0.9.1 might make it easier for remote attackers to guess the VNC password, which is limited to seven characters where eight was intended."
    },
    {
      "lang": "es",
      "value": "Error de superaci\u00f3n de l\u00edmite (off-by-one) en monitor.c en Qemu 0.9.1 podr\u00eda facilitar a atacantes remotos adivinar la contrase\u00f1a VNC, que est\u00e1 limitada a siete caracteres cuando se habr\u00edan previsto ocho."
    }
  ],
  "id": "CVE-2008-5714",
  "lastModified": "2026-06-16T23:00:51.747",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.8,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-12-24T18:29:15.890",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.gnu.org/archive/html/qemu-devel/2008-11/msg01224.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.gnu.org/archive/html/qemu-devel/2008-12/msg00498.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/33568"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/34642"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/35062"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://svn.savannah.gnu.org/viewvc/?view=rev\u0026root=qemu\u0026revision=5966"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://svn.savannah.gnu.org/viewvc/trunk/monitor.c?root=qemu\u0026r1=5966\u0026r2=5965\u0026pathrev=5966"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/33020"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/usn-776-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47683"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.gnu.org/archive/html/qemu-devel/2008-11/msg01224.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.gnu.org/archive/html/qemu-devel/2008-12/msg00498.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33568"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/34642"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/35062"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.savannah.gnu.org/viewvc/?view=rev\u0026root=qemu\u0026revision=5966"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://svn.savannah.gnu.org/viewvc/trunk/monitor.c?root=qemu\u0026r1=5966\u0026r2=5965\u0026pathrev=5966"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/33020"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-776-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47683"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "Not vulnerable. This issue did not affect the versions of Xen as shipped with Red Hat Enterprise Linux 5.",
      "lastModified": "2009-02-26T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.