Multiple Vendor Libcurses Buffer Overflow Vulnerability
BID:2866
Info
Multiple Vendor Libcurses Buffer Overflow Vulnerability
| Bugtraq ID: | 2866 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 12 2001 12:00AM |
| Updated: | Jun 12 2001 12:00AM |
| Credit: | Discovered by Aycan Irican <[email protected]>. Additional vulnerable software discoveries by KF <[email protected]>. |
| Vulnerable: |
Sun SunOS 5.8 _x86 Sun SunOS 5.8 Sun SunOS 5.7 _x86 Sun SunOS 5.7 Sun SunOS 5.6 _x86 Sun SunOS 5.6 Sun SunOS 5.5.1 _x86 Sun SunOS 5.5.1 _ppc Sun SunOS 5.5.1 Sun SunOS 5.5 _x86 Sun SunOS 5.5 Sun SunOS 5.4 _x86 Sun SunOS 5.4 Sun SunOS 5.3 Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.8 Sun Solaris 2.7_sparc Sun Solaris 2.7 Sun Solaris 2.6_x86HW5/98 Sun Solaris 2.6_x86HW3/98 Sun Solaris 2.6_x86 Sun Solaris 2.6_sparc Sun Solaris 2.6 HW5/98 Sun Solaris 2.6 HW3/98 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 XFS SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 SGI IRIX 4.0.5 IPR SGI IRIX 4.0.5 H SGI IRIX 4.0.5 G SGI IRIX 4.0.5 F SGI IRIX 4.0.5 E SGI IRIX 4.0.5 D SGI IRIX 4.0.5 A SGI IRIX 4.0.5 (IOP) SGI IRIX 4.0.5 SGI IRIX 4.0.4 T SGI IRIX 4.0.4 B SGI IRIX 4.0.4 SGI IRIX 4.0.3 SGI IRIX 4.0.2 SGI IRIX 4.0.1 T SGI IRIX 4.0.1 SGI IRIX 4.0 SGI IRIX 3.3.3 SGI IRIX 3.3.2 SGI IRIX 3.3.1 SGI IRIX 3.3 SGI IRIX 3.2 SCO Unixware 7.1.1 SCO Unixware 7.1 SCO Unixware 7.0.1 SCO Unixware 7.0 SCO Open Server 5.0.6 SCO Open Server 5.0.5 SCO Open Server 5.0.4 SCO Open Server 5.0.3 SCO Open Server 5.0.2 SCO Open Server 5.0.1 SCO Open Server 5.0 Caldera OpenUnix 8.0 |
| Not Vulnerable: | |
Discussion
Multiple Vendor Libcurses Buffer Overflow Vulnerability
The curses library is a basic system library that is used for CRT screen handling. It is used by many terminal independent character-based applications.
The version of libcurses used by multiple vendors contains a buffer overflow vulnerability.
Malicious local users may be able to exploit this vulnerability in setuid programs linked to libcurses to elevate privileges.
The curses library is a basic system library that is used for CRT screen handling. It is used by many terminal independent character-based applications.
The version of libcurses used by multiple vendors contains a buffer overflow vulnerability.
Malicious local users may be able to exploit this vulnerability in setuid programs linked to libcurses to elevate privileges.
Exploit / POC
Multiple Vendor Libcurses Buffer Overflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple Vendor Libcurses Buffer Overflow Vulnerability
References:
References: