Abuse Local Buffer Overflow Vulnerability
BID:6094
Info
Abuse Local Buffer Overflow Vulnerability
| Bugtraq ID: | 6094 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-1250 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 01 2002 12:00AM |
| Updated: | Jul 11 2009 06:06PM |
| Credit: | Discovery of this vulnerability credited to Texonet (http://www.texonet.com). |
| Vulnerable: |
Abuse Abuse 2.0 |
| Not Vulnerable: | |
Discussion
Abuse Local Buffer Overflow Vulnerability
Vulnerabilities have been discovered in two files used by Abuse.
By passing an execessively long commandline argument to Abuse, it is possible to overrun a buffer. Exploiting this issue could allow a local attacker to overwrite sensitive memory variables, resulting in the execution of arbitrary code, within the context of Abuse process.
It should be noted that one of the affected files is installed setuid root.
It should also be noted that Abuse 2.00, packaged and distributed with the x86 architecture of Debian Linux 3.0 has been reported vulnerable. It is not yet known if other packages are affected by this issue.
Vulnerabilities have been discovered in two files used by Abuse.
By passing an execessively long commandline argument to Abuse, it is possible to overrun a buffer. Exploiting this issue could allow a local attacker to overwrite sensitive memory variables, resulting in the execution of arbitrary code, within the context of Abuse process.
It should be noted that one of the affected files is installed setuid root.
It should also be noted that Abuse 2.00, packaged and distributed with the x86 architecture of Debian Linux 3.0 has been reported vulnerable. It is not yet known if other packages are affected by this issue.
Solution / Fix
Abuse Local Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Abuse Local Buffer Overflow Vulnerability
References:
References:
- Abuse Product Page (http://www.abuse2.com/)
- iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability ("David Endler"