PT-2003-1005 · Slocate · Slocate

Patrik Hornik · Published 2003-10-09 · Updated 2017-10-11 · CVE-2003-0848

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions slocate versions 2.6 through 2.7

Description The issue is related to multiple vulnerabilities in the slocate package, which can lead to a breach of confidentiality, integrity, and availability of protected information. A heap-based buffer overflow in the main.c file of slocate version 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative pathlen value to be used. The vulnerability can be exploited locally.

Recommendations For slocate version 2.6, consider restricting access to the slocate database to minimize the risk of exploitation. For slocate version 2.7, avoid using the vulnerable package until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-01421

BDU:2015-07826

CVE-2003-0848

DSA-428

RHSA-2004:041

Affected Products

Slocate

References · 30

• 🔥 https://exploit-db.com/exploits/23228 · Exploit
• https://bdu.fstec.ru/vul/2015-07826 · Security Note
• http://trustix.org/errata/misc/2004/TSL-2004-0005-slocate.asc.txt · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2004-January/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0848 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2004:004 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-041.html · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/CSSA-2004-001.0.txt · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040201-01-U.asc · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2004-040.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01421 · Security Note
• http://debian.org/security/2004/dsa-428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0848 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A821 · Note