CVE-2008-3969

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handling of the USTATUS_IDENTIFIED state." NOTE: this issue exists because of an incomplete fix for CVE-2008-3920.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/31690Third Party Advisory
http://secunia.com/advisories/31991Third Party Advisory
http://security.gentoo.org/glsa/glsa-200809-14.xmlThird Party Advisory
http://www.bitlbee.org/main.php/changelog.htmlRelease Notes, Vendor Advisory
http://www.bitlbee.org/main.php/news.r.htmlRelease Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2008/09/08/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/09/09/11Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/31342Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=461424Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45132Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.htmlThird Party Advisory
http://secunia.com/advisories/31690Third Party Advisory
http://secunia.com/advisories/31991Third Party Advisory
http://security.gentoo.org/glsa/glsa-200809-14.xmlThird Party Advisory
http://www.bitlbee.org/main.php/changelog.htmlRelease Notes, Vendor Advisory
http://www.bitlbee.org/main.php/news.r.htmlRelease Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2008/09/08/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/09/09/11Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/31342Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=461424Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45132Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00587.htmlThird Party Advisory

Timeline

Published: Sep 11, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-39706.9pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volum CVE-2008-39719.3Heap-based buffer overflow in the open_man_file function in callbacks.c in gmanedit 0.4.1 allows remote attackers to execute arbitrary code CVE-2008-39726.6pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, whi CVE-2008-39731.7Unspecified vulnerability in the SQL*Plus Windows GUI component in Oracle Database allows local users to affect confidentiality via unknown CVE-2008-39744.0Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.0.2.8 and 9.2.0.8DV allows remote authenticated users to affect CVE-2008-39755.0Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3 and 10.1.2.3 allows remote attackers to affect CVE-2008-39765.5Unspecified vulnerability in the Oracle Spatial component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authen CVE-2008-39775.0Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3 and 10.1.2.3 allows remote attackers to affect CVE-2008-39785.5Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 allows remote authenticated users to affect confidenti CVE-2008-39795.5Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affe CVE-2008-39804.9Unspecified vulnerability in the Upgrade component in Oracle Database 10.1.0.5 and 10.2.0.3 allows remote authenticated users to affect conf CVE-2008-39815.0Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.1.0.1 allows remote attackers to affect confident