Libopt.a Error Logging Buffer Overflow Vulnerability

BID:7433

Info

Libopt.a Error Logging Buffer Overflow Vulnerability

Bugtraq ID: 7433
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: Yes
Published: Apr 24 2003 12:00AM
Updated: Apr 24 2003 12:00AM
Credit: Discovery of this vulnerability has been credited to KF <[email protected]>.
Vulnerable: James Theiler opt 3.18
James Theiler opt 3.17
James Theiler opt 3.16
James Theiler opt 3.13
James Theiler opt 3.12
Not Vulnerable: James Theiler opt 3.19

Discussion

Libopt.a Error Logging Buffer Overflow Vulnerability

Libopt library has been reported prone to a buffer overflow vulnerability.

It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.

Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.

It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected.

Exploit / POC

Libopt.a Error Logging Buffer Overflow Vulnerability

A sample program implementing the opt_atoi() function and a proof of concept exploit have been made available to demonstrate this vulnerability.

Solution / Fix

Libopt.a Error Logging Buffer Overflow Vulnerability

Solution:
The vendor has addressed this issue in the current version of the library. Users are advised to relink applications that use libopt.a against the new version of opt:


James Theiler opt 3.12

James Theiler opt 3.13

James Theiler opt 3.16

James Theiler opt 3.17

James Theiler opt 3.18

References

Libopt.a Error Logging Buffer Overflow Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report