Buffer overflow in Esri Arcsde

CVE-2007-1770

Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service (giomgr crash) and execute arbitrary code via long parameters in crafted requests.

Vulnerability class: Buffer Overflow

EPSS: 0.167 (96.7th percentile) — read the EPSS interpretation.

Affected products

  • Esri Arcsde — versions 8.3, 9.0, 9.1
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
  • cve@mitre.org (x_refsource_IDEFENSE, Broken Link, third-party-advisory)
  • cve@mitre.org (Third Party Advisory, vdb-entry, Broken Link, x_refsource_VUPEN)

Frequently asked questions

What is CVE-2007-1770?
CVE-2007-1770 is a vulnerability in Esri Arcsde, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). Published 2007-03-30.
Is CVE-2007-1770 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.