PT-2003-1537 · Hewlett Packard+1 · Hp-Ux+1

Bt · Published 2003-05-19 · Updated 2017-07-11 · CVE-2003-0333

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: C-Kermit versions 6.0.192 and earlier

Description: The issue is related to multiple buffer overflows in the kermit software, specifically in HP-UX versions 10.20 and 11.00, which can be exploited by local users to gain privileges. This is achieved by providing long arguments to certain functions, including ask, askq, define, assign, and getc. Some of these functions may share the same underlying function doask.

Recommendations: For C-Kermit versions 6.0.192 and earlier, consider updating to version 8.0 or later to resolve the issue. As a temporary workaround, restrict the use of the ask, askq, define, assign, and getc functions to minimize the risk of exploitation. Additionally, be cautious when providing arguments to these functions to avoid triggering the buffer overflow.

Fix

Related Identifiers

CVE-2003-0333

Affected Products

C-Kermit

Hp-Ux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2003-0333 · Security Note
• http://archives.neohapsis.com/archives/hp/current/0044.html · Vendor Advisory
• http://securityfocus.com/bid/7627 · Vendor Advisory
• http://kb.cert.org/vuls/id/971364 · Note
• http://marc.info/?l=bugtraq&m=105189670912220&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11929 · Note
• http://marc.info/?l=bugtraq&m=105190667523456&w=2 · Note