PT-2003-1806 · Kismac · Kismac

Published 2003-09-12 · Updated 2017-07-11 · CVE-2003-0703

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: KisMAC versions prior to 0.05d

Description: The issue allows local users to gain privileges by exploiting the trust in user-supplied variables to load arbitrary kernels or kernel modules. This can be achieved via the $DRIVER KEXT environment variable in scripts such as viha driver.sh, macjack load.sh, or airojack load.sh, or through similar techniques using exchangeKernel.sh.

Recommendations: For KisMAC versions prior to 0.05d, update to version 0.05d or later to resolve the issue. As a temporary workaround, consider restricting the use of the $DRIVER KEXT environment variable and limiting the execution of scripts like viha driver.sh, macjack load.sh, airojack load.sh, and exchangeKernel.sh to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2003-0703

Affected Products

Kismac

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-0703 · Security Note
• http://securityfocus.com/bid/8497 · Vendor Advisory
• http://atstake.com/research/advisories/2003/a082203-1.txt · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13007 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13008 · Note