PT-2003-1012 · Debian · Leksbot

Published 2003-05-08 · Updated 2017-07-11 · CVE-2003-0262

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions leksbot version 1.2.3

Description The issue concerns multiple vulnerabilities in the leksbot package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited to compromise the confidentiality, integrity, and availability of protected information. Specifically, the leksbot package installs KATAXWR as setuid root, allowing local users to gain root privileges by exploiting unknown vulnerabilities related to the escalated privileges that KATAXWR is not designed to have.

Recommendations For leksbot version 1.2.3, consider removing the setuid root bit from KATAXWR to prevent local users from gaining root privileges until a patch is available. As a temporary workaround, restrict access to the KATAXWR utility to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-01793

CVE-2003-0262

DSA-299

Affected Products

Leksbot

References · 8

• 🔥 https://exploit-db.com/exploits/22567 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0262 · Security Note
• https://bdu.fstec.ru/vul/2015-01793 · Security Note
• http://debian.org/security/2003/dsa-299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0262 · Security Note
• http://debian.org/security/dsa-299 · Note
• http://securityfocus.com/bid/7505 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11945 · Note