PT-2003-1012 · Debian · Leksbot

Publicado 2003-05-08 · Atualizado 2017-07-11 · CVE-2003-0262

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions leksbot version 1.2.3

Description The issue concerns multiple vulnerabilities in the leksbot package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited to compromise the confidentiality, integrity, and availability of protected information. Specifically, the leksbot package installs KATAXWR as setuid root, allowing local users to gain root privileges by exploiting unknown vulnerabilities related to the escalated privileges that KATAXWR is not designed to have.

Recommendations For leksbot version 1.2.3, consider removing the setuid root bit from KATAXWR to prevent local users from gaining root privileges until a patch is available. As a temporary workaround, restrict access to the KATAXWR utility to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

BDU:2015-01793

CVE-2003-0262

DSA-299

Produtos afetados

Leksbot

Referências · 8

• 🔥 https://exploit-db.com/exploits/22567 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0262 · Nota de Segurança
• http://debian.org/security/dsa-299 · Nota
• https://bdu.fstec.ru/vul/2015-01793 · Nota de Segurança
• http://debian.org/security/2003/dsa-299 · Aviso do Fabricante
• http://securityfocus.com/bid/7505 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0262 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11945 · Nota