PT-2001-2271 · Progress · Progress

Published 2001-11-02 · Updated 2017-12-19 · CVE-2001-1129

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Progress database version 9.1C

Description The issue allows a local user to execute arbitrary code via format string specifiers in the file used by the PROMSGS environment variable. This is due to format string vulnerabilities in multiple components, including probuild, dbutil, mprosrv, mprshut, proapsv, progres, proutil, rfutil, and prolib.

Recommendations For Progress database version 9.1C, consider restricting access to the PROMSGS environment variable to minimize the risk of exploitation. As a temporary workaround, avoid using format string specifiers in the file used by the PROMSGS environment variable until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2001-1129

Affected Products

Progress

References · 4

• http://securityfocus.com/bid/3502 · Vendor Advisory
• http://securityfocus.com/archive/1/224395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1129 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7457 · Note