PT-2003-2367 · Syslinux · Syslinux

Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1422

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SYSLINUX version 2.01

Description The issue involves multiple unspecified vulnerabilities in the SYSLINUX installer. When the installer runs with setuid root privileges, local users can exploit these vulnerabilities to gain elevated privileges. The exact vectors used for the exploitation are not specified.

Recommendations For SYSLINUX version 2.01, consider removing the setuid root bit from the installer to prevent privilege escalation until a fixed version is available. As a temporary workaround, restrict access to the installer to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2003-1422

Produtos afetados

Syslinux

Referências · 5

• http://syslinux.zytor.com/history.php · Nota
• http://secunia.com/advisories/8077 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-1422 · Nota de Segurança
• http://securityfocus.com/bid/6876 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11351 · Nota