PT-2003-1053 · Gnu · Man

Daniel Ahlberg · Published 2003-03-18 · Updated 2017-10-10 · CVE-2003-0124

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions man versions prior to 1.5l

Description The issue allows attackers to execute arbitrary code via a malformed man file with improper quotes. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of the issue can be carried out locally.

Recommendations For versions prior to 1.5l, update to version 1.5l or later to resolve the issue. As a temporary workaround, consider restricting access to malformed man files to minimize the risk of exploitation. Avoid using the my xsprintf function in the affected man package until the issue is resolved.

Exploit

Fix

Related Identifiers

BDU:2015-07809

BDU:2015-07810

CVE-2003-0124

Affected Products

Man

References · 12

• 🔥 http://securityfocus.com/bid/7066 · Exploit
• 🔥 https://exploit-db.com/exploits/22344 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-0124 · Security Note
• http://redhat.com/support/errata/RHSA-2003-134.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=104802285112752&w=2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07809 · Security Note
• http://redhat.com/support/errata/RHSA-2003-133.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000620 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07810 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11512 · Note
• https://rhn.redhat.com/errata/RHSA-2003-133.html · Note
• http://marc.info/?l=bugtraq&m=104740927915154&w=2 · Note