CVE-2008-3871

Published: Apr 1, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Multiple format string vulnerabilities in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers to execute arbitrary code via format string specifiers in the filename of a (1) DAA or (2) ISZ file.

Affected (1)

Products: Ezbsystems: Ultraiso

Ezbsystems

1 product

Ultraiso

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ezbsystems Ultraiso	Version 9.3.1.2633

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (14)

http://secunia.com/advisories/32415

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://secunia.com/secunia_research/2008-48/

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://www.ezbsystems.com/ultraiso/history.htm

Source: PSIRT-CNA@flexerasoftware.com

Patch

http://www.securityfocus.com/archive/1/502324/100/0/threaded

Source: PSIRT-CNA@flexerasoftware.com

http://www.securityfocus.com/bid/34325

Source: PSIRT-CNA@flexerasoftware.com

http://www.securitytracker.com/id?1021965

Source: PSIRT-CNA@flexerasoftware.com

http://www.vupen.com/english/advisories/2009/0903

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/advisories/32415