PT-2003-1167 · Openbsd · Openbsd

Published 2003-04-11 · Updated 2016-10-18 · CVE-2002-1420

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenBSD versions 3.1 and earlier

Description The issue is caused by an integer signedness error in the select() function, which allows local users to overwrite arbitrary kernel memory. This occurs when a negative value is provided for the size parameter, satisfying the boundary check as a signed integer but later being used as an unsigned integer during a data copying operation.

Recommendations For OpenBSD versions 3.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1420

Affected Products

Openbsd

References · 6

• http://iss.net/security_center/static/9809.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1420 · Security Note
• http://securityfocus.com/bid/5442 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=102918817012863&w=2 · Note
• http://kb.cert.org/vuls/id/259787 · Note
• http://osvdb.org/7554 · Note