PT-2003-1015 · Nanog · Traceroute-Nanog

Bazarr · Published 2003-06-24 · Updated 2016-10-18 · CVE-2003-0453

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions traceroute-nanog version 6.1.1

Description The issue allows local users to potentially execute arbitrary code via certain arguments that cause an integer overflow, leading to a buffer overflow. This can be achieved by exploiting the nprobes and max ttl arguments. Additionally, there are multiple vulnerabilities in the traceroute-nanog package that can lead to disruption of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For traceroute-nanog version 6.1.1, consider restricting the use of the nprobes and max ttl arguments to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using these arguments in sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-02022

CVE-2003-0453

DSA-348

Affected Products

Traceroute-Nanog

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-0453 · Security Note
• https://bdu.fstec.ru/vul/2015-02022 · Security Note
• http://debian.org/security/2003/dsa-348 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0453 · Security Note
• http://debian.org/security/dsa-348 · Note
• http://marc.info/?l=bugtraq&m=105613905425563&w=2 · Note