CVE-2014-5439

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/129292/Sniffit-Root-Shell.htmlExploit, Patch, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Nov/88
http://www.securityfocus.com/bid/71318
http://packetstormsecurity.com/files/129292/Sniffit-Root-Shell.htmlExploit, Patch, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Nov/88
http://www.securityfocus.com/bid/71318

Timeline

Published: Nov 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-54407.5SQL injection vulnerability in Login.aspx in MPEX Business Solutions MX-SmartTimer before 13.19.18 allows remote attackers to execute arbitr CVE-2014-54414.3Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote at CVE-2014-54437.8Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet h CVE-2014-54444.3Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attac CVE-2014-54455.0Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attacker CVE-2014-54465.0Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow CVE-2014-54472.1Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive informa CVE-2014-54482.1Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by CVE-2014-54492.1Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sen CVE-2014-54505.5Zarafa Collaboration Platform 4.1 uses world-readable permissions for /etc/zarafa/license, which allows local users to obtain sensitive info CVE-2014-54514.3Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attac CVE-2014-54524.3CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allow