CVE-2014-5439
sniffit 0.3.7 and prior: A configuration file can be leveraged to execute code as root
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
- Record
CVE-2014-5439- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
- Record
CVE-2014-5439- Updated
- 2026-11-02
EUVDEUVD-2014-5327 No score
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
- Record
EUVD-2014-5327- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p45p-3fx5-h8qr
sniffit 0.3.7 and prior: A configuration file can be leveraged to execute code as root
sniffit 0.3.7 and prior: A configuration file can be leveraged to execute code as root
- Record
GHSA-p45p-3fx5-h8qr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
- Record
CVE-2014-5439- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5439
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
- Record
DEBIAN-CVE-2014-5439- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-5439
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.
- Record
UBUNTU-CVE-2014-5439- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-4652-1 No score
sniffit vulnerability
It was discovered that SniffIt incorrectly handled certain configuration files. An attacker could possibly use this issue to execute arbitrary code.
- Record
USN-4652-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sniffitDebian:12 |
before 0.3.7.beta-20 | 0.3.7.beta-20 |
sniffitDebian:14 |
before 0.3.7.beta-20, plus listed versions 0.3.5-30.3.7.beta-100.3.7.beta-110.3.7.beta-120.3.7.beta-13 Show 9 moreShow less0.3.7.beta-140.3.7.beta-150.3.7.beta-15.10.3.7.beta-160.3.7.beta-16.10.3.7.beta-170.3.7.beta-180.3.7.beta-190.3.7.beta-6.1 |
0.3.7.beta-20 |
sniffitDebian:7 |
before 0.3.7.beta-16.1+deb7u1, plus listed versions 0.3.7.beta-16.1 |
0.3.7.beta-16.1+deb7u1 |
sniffitUbuntu:14.04:LTS |
before 0.3.7.beta-17+deb8u1build0.14.04.1, plus listed versions 0.3.7.beta-17 |
0.3.7.beta-17+deb8u1build0.14.04.1 |
sniffitUbuntu:16.04:LTS |
before 0.3.7.beta-19ubuntu0.1, plus listed versions 0.3.7.beta-190.3.7.beta-19build1 |
0.3.7.beta-19ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-5439 is a high vulnerability (CVSS 7.8) in Sniffit Project Sniffit, published November 21, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.55%, the 85th percentile. Fixed in sniffit 0.3.7.beta-20.