PT-2003-1167 · Openbsd · Openbsd

Publicado 2003-04-11 · Atualizado 2016-10-18 · CVE-2002-1420

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenBSD versions 3.1 and earlier

Description The issue is caused by an integer signedness error in the select() function, which allows local users to overwrite arbitrary kernel memory. This occurs when a negative value is provided for the size parameter, satisfying the boundary check as a signed integer but later being used as an unsigned integer during a data copying operation.

Recommendations For OpenBSD versions 3.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-1420

Produtos afetados

Openbsd

Referências · 6

• http://marc.info/?l=bugtraq&m=102918817012863&w=2 · Nota
• http://kb.cert.org/vuls/id/259787 · Nota
• http://iss.net/security_center/static/9809.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1420 · Nota de Segurança
• http://osvdb.org/7554 · Nota
• http://securityfocus.com/bid/5442 · Aviso do Fabricante