PT-2003-2367 · Syslinux · Syslinux

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1422

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SYSLINUX version 2.01

Description The issue involves multiple unspecified vulnerabilities in the SYSLINUX installer. When the installer runs with setuid root privileges, local users can exploit these vulnerabilities to gain elevated privileges. The exact vectors used for the exploitation are not specified.

Recommendations For SYSLINUX version 2.01, consider removing the setuid root bit from the installer to prevent privilege escalation until a fixed version is available. As a temporary workaround, restrict access to the installer to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2003-1422

Affected Products

Syslinux

References · 5

• http://secunia.com/advisories/8077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1422 · Security Note
• http://securityfocus.com/bid/6876 · Patch
• http://syslinux.zytor.com/history.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11351 · Note