PT-2003-1938 · Unknown · Xscreensaver

Stan Bubrouski · Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-0885

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xscreensaver version 4.14

Description The issue is related to certain debugging code that was not removed from Xscreensaver, leading to insecure creation of temporary files in the apple2, xanalogtv, and pong screensavers. This allows local users to overwrite arbitrary files via a symlink attack.

Recommendations For Xscreensaver version 4.14, consider removing or disabling the affected screensavers (apple2, xanalogtv, and pong) until a patch is available to prevent local users from exploiting this issue.

Exploit

Fix

Related Identifiers

CVE-2003-0885

Affected Products

Xscreensaver

References · 6

• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=41253 · Exploit
• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182286 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0885 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0885 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0885 · Vendor Advisory