PT-2003-1051 · Gnu · File

David Endler · Published 2003-03-05 · Updated 2018-05-03 · CVE-2003-0102

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions file versions 3.39

Description The issue is related to a buffer overflow in the tryelf() function in readelf.c of the file command, which allows attackers to execute arbitrary code as the user running file. This can be achieved possibly via a large entity size value in an ELF header (elfhdr.e shentsize). The exploitation of this issue can lead to a violation of confidentiality, integrity, and availability of protected information and can be performed locally.

Recommendations For file version 3.39, consider restricting access to the tryelf() function in readelf.c until a patch is available. As a temporary workaround, avoid using large entity size values in ELF headers to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-07796

CVE-2003-0102

DSA-260

Affected Products

File

References · 20

• 🔥 https://exploit-db.com/exploits/22325 · Exploit
• 🔥 https://exploit-db.com/exploits/22324 · Exploit
• 🔥 http://idefense.com/advisory/03.04.03.txt · Exploit
• http://debian.org/security/2003/dsa-260 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-087.html · Vendor Advisory
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:030 · Vendor Advisory
• http://securityfocus.com/bid/7008 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0102 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0102 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-086.html · Vendor Advisory
• http://lwn.net/Alerts/34908 · Vendor Advisory
• http://novell.com/linux/security/advisories/2003_017_file.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07796 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-0102 · Security Note