PT-2002-2893 · Openbsd · Openbsd

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2180

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: OpenBSD versions 2.0 through 3.1

Description: The issue is related to the setitimer(2) system call, which does not properly check certain arguments. This allows local users to write to kernel memory, potentially gaining root privileges. The problem may be caused by an integer signedness error.

Recommendations: For OpenBSD versions 2.0 through 3.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-2180

Affected Products

Openbsd

References · 5

• 🔥 http://openbsd.org/plus32.html · Exploit
• http://iss.net/security_center/static/10278.php · Vendor Advisory
• http://securityfocus.com/bid/5861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-2180 · Security Note
• ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/032_kerntime.patch · Patch