PT-2004-1042 · Debian · Xsok

Publicado 2004-01-14 · Atualizado 2017-07-11 · CVE-2003-0949

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xsok version 1.02

Description The issue allows local users to execute arbitrary commands due to xsok not properly dropping privileges before finding and executing the "gunzip" program. Additionally, there are multiple vulnerabilities in the xsok package of the Debian GNU/Linux operating system that can lead to breaches of confidentiality, integrity, and availability of protected information, which can be exploited by a local attacker.

Recommendations For xsok version 1.02, consider updating to a newer version that properly handles privilege dropping to prevent arbitrary command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-04085

CVE-2003-0949

DSA-405

Produtos afetados

Xsok

Referências · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0949 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2003-0949 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14098 · Nota
• http://debian.org/security/2003/dsa-405 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2003-0949 · Aviso do Fabricante
• http://debian.org/security/dsa-405 · Nota
• https://bdu.fstec.ru/vul/2015-04085 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2003-0949 · Aviso do Fabricante
• http://securityfocus.com/bid/9321 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0949 · Aviso do Fabricante