CVE-2003-0849
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute...
CVE-2003-0849 is a high vulnerability (CVSS 7.5) in Gnu Cfengine, published October 9, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.9%, the 95th percentile. No source names a fixed version.
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
- Record
CVE-2003-0849- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
- Record
CVE-2003-0849- Updated
- 2026-11-02
EUVDEUVD-2003-0840 No score
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
- Record
EUVD-2003-0840- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6q3f-pvg5-m3gm No score
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute...
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
- Record
GHSA-6q3f-pvg5-m3gm- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GNU CFEngine 2.-2.0.3 - Remote Stack Overflow | 2003-09-27 |
| Exploit-DB | GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (1) | 2003-09-25 |
| Exploit-DB | GNU CFEngine 2.0.x - CFServD Transaction Packet Buffer Overrun (2) | 2003-11-04 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |