PT-2003-1026 · Debian · Epic4+1

Timo Sirainen · Published 2003-05-22 · Updated 2016-10-18 · CVE-2003-0324

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EPIC4 version 1.0.1

Description The issue concerns multiple vulnerabilities in the EPIC package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, buffer overflows in the EPIC IRC Client can cause a denial of service or possibly execute arbitrary code when the client receives long replies that are not properly handled by the userhost cmd returned function or the Statusbar capability.

Recommendations For EPIC4 version 1.0.1, consider disabling the userhost cmd returned function and restricting the use of the Statusbar capability until a patch is available to prevent potential exploitation. Additionally, restrict access to the EPIC IRC Client to minimize the risk of remote malicious IRC servers causing a denial of service or executing arbitrary code.

Fix

Related Identifiers

BDU:2015-03390

CVE-2003-0324

DSA-287

Affected Products

Debian

Epic4

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0324 · Security Note
• https://bdu.fstec.ru/vul/2015-03390 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0324 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0324 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0324 · Vendor Advisory
• http://debian.org/security/2003/dsa-287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0324 · Security Note
• http://debian.org/security/dsa-287 · Note
• http://marc.info/?l=bugtraq&m=104766521328322&w=2 · Note
• http://securityfocus.com/bid/7091 · Note