PT-2000-1006 · Gnu · Glibc

Published 2000-09-30 · Updated 2016-10-18 · CVE-2000-1207

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions usermode versions 1.37 SysVinit version 2.78

Description The issue allows for the exploitation of format string vulnerabilities in glibc via the LANG or LC ALL environment variables. This can lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation can be carried out locally.

Recommendations For usermode version 1.37, consider disabling the execution of non-setuid programs as root until a patch is available. For SysVinit version 2.78, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-07830

BDU:2015-07833

CVE-2000-1207

Affected Products

Glibc

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2000-1207 · Security Note
• http://redhat.com/support/errata/RHSA-2000-075.html · Vendor Advisory
• http://linux-mandrake.com/en/security/2000/MDKSA-2000-059.php3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07833 · Security Note
• https://bdu.fstec.ru/vul/2015-07830 · Security Note
• http://marc.info/?l=bugtraq&m=97034397026473&w=2 · Note
• http://marc.info/?l=bugtraq&m=97063854808796&w=2 · Note
• https://rhn.redhat.com/errata/RHSA-2000-075.html · Note