PT-2003-1973 · Openbsd · Openbsd

Georgi Guninski · Published 2003-11-21 · Updated 2016-10-18 · CVE-2003-0955

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBSD kernel versions 3.3 and 3.4

Description The issue allows local users to cause a denial of service, potentially leading to a kernel panic, and may also enable the execution of arbitrary code in version 3.4. This is due to improper handling of a program with an invalid header by the iBCS2 emulation (compat ibcs2) in ibcs2 exec.c or by exec elf.c, resulting in a stack-based buffer overflow.

Recommendations For OpenBSD kernel version 3.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For OpenBSD kernel version 3.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2003-0955

Affected Products

Openbsd

References · 10

• 🔥 http://guninski.com/msuxobsd2.html · Exploit
• 🔥 https://exploit-db.com/exploits/118 · Exploit
• 🔥 https://exploit-db.com/exploits/125 · Exploit
• http://openbsd.org/errata33.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0955 · Security Note
• http://securityfocus.com/bid/8978 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/013315.html · Note
• http://marc.info/?l=openbsd-security-announce&m=106808820119679&w=2 · Note
• http://marc.info/?l=openbsd-security-announce&m=106917441524978&w=2 · Note
• ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/005_exec.patch · Patch, Vendor Advisory