Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.9

OpenBSD and Interix crash on deep directory trees

CVE-2009-0537 · published 17 years ago
Summary

Versions of OpenBSD up to 4.4 and Microsoft Interix 6.0 can crash when they process very deep folder structures. An attacker who can create or influence such a directory tree can make utilities like du, rm, chmod, chgrp, or SearchIndexer.exe stop working. Apply the vendor's patches or limit the depth of directory hierarchies to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft interix 6.0
cpe:2.3:a:microsoft:interix:6.0:*:10.0.6030.0:*:*:*:*:*
openbsd openbsd <= 4.4
2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
3.0
13 more version ranges
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*
Original advisory text
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of se...
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.9 Medium
Exploitation
4% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published9 Mar 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-0537 · NVD
Track software like this
Free during beta