PT-2004-1392 · 0Verkill · 0Verkill

Pi3Ki31Ny · Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0238

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 0verkill version 0.15pre3

Description The issue is related to multiple buffer overflows that could allow local users to execute arbitrary code in the client via a long HOME environment variable in the load cfg and save cfg functions. Additionally, it might allow remote attackers to execute arbitrary code via long strings to the send message function, and in the server, via the parse command line function.

Recommendations For 0verkill version 0.15pre3, as a temporary workaround, consider restricting the length of the HOME environment variable and input strings to the send message and parse command line functions until a patch is available. Avoid using long strings in these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0238

Affected Products

0Verkill

References · 8

• 🔥 https://exploit-db.com/exploits/23634 · Exploit
• 🔥 http://securityfocus.com/bid/9550 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0238 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15000 · Note
• http://securiteam.com/securitynews/5AP010KC0C.html · Note
• http://marc.info/?l=bugtraq&m=107577335424509&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14999 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/016579.html · Note