PT-2003-1212 · Netbsd+2 · Libc+3

Publicado 2003-04-22 · Atualizado 2008-09-05 · CVE-2002-1476

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetBSD versions 1.4.x through 1.6

Description A buffer overflow issue exists in the setlocale function within libc on NetBSD. This occurs when the function is called with the LC ALL category and a user-controlled locale string that has more than 6 elements, exceeding the boundaries of the new categories category array. This can be exploited through programs such as xterm and zsh, allowing local attackers to execute arbitrary code.

Recommendations For NetBSD versions 1.4.x through 1.6, consider restricting the use of the setlocale function with the LC ALL category until a patch is available. As a temporary workaround, limit the number of elements in user-controlled locale strings to prevent buffer overflow.

Correção

Identificadores relacionados

CVE-2002-1476

Produtos afetados

Netbsd

Libc

Xterm

Zsh

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1476 · Nota de Segurança
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-012.txt.asc · Aviso do Fabricante
• http://securityfocus.com/bid/5724 · Aviso do Fabricante
• http://osvdb.org/7565 · Nota
• http://iss.net/security_center/static/10159.php · Aviso do Fabricante