PT-2004-2222 · User Mode Linux · Uml-Utilities

Published 2004-12-22 · Updated 2017-07-11 · CVE-2004-1295

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: uml-utilities version 20030903

Description: The issue concerns the slip down function in slip.c for the uml net program. It does not verify whether the calling user has sufficient permission to disable an interface. This allows local users to cause a denial of service by disabling the network service.

Recommendations: For uml-utilities version 20030903, consider restricting access to the uml net program when it is installed setuid root, to prevent local users from disabling network interfaces without proper authorization. As a temporary workaround, consider disabling the slip down function in slip.c until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2004-1295

Affected Products

Uml-Utilities

References · 3

• 🔥 http://tigger.uic.edu/~jlongs2/holes/uml-utilites.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1295 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18562 · Note