CVE-2003-0124

Current Description

man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value "unsafe," which is then executed as a program via a system call if it is in the search path of the user who runs man.

Basic Data

PublishedMarch 18, 2003
Last ModifiedOctober 10, 2017
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeNVD-CWE-Other
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorLOCAL
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score4.6
SeverityMEDIUM
Exploitability Score3.9
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegetrue
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationAndries BrouwerMan1.5h1*******
    2.3ApplicationAndries BrouwerMan1.5i*******
    2.3ApplicationAndries BrouwerMan1.5i2*******
    2.3ApplicationAndries BrouwerMan1.5j*******
    2.3ApplicationAndries BrouwerMan1.5k*******

Vulnerable Software List

VendorProductVersions
Andries Brouwer Man 1.5h1, 1.5i, 1.5i2, 1.5j, 1.5k

References

NameSourceURLTags
CLSA-2003:620http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000620CONECTIVA
20030311 Vulnerability in man < 1.5lhttp://marc.info/?l=bugtraq&m=104740927915154&w=2BUGTRAQ
GLSA-200303-13http://marc.info/?l=bugtraq&m=104802285112752&w=2GENTOO
RHSA-2003:133http://www.redhat.com/support/errata/RHSA-2003-133.htmlREDHAT
RHSA-2003:134http://www.redhat.com/support/errata/RHSA-2003-134.htmlREDHAT
7066http://www.securityfocus.com/bid/7066BIDExploit Patch Vendor Advisory
man-myxsprintf-code-execution(11512)https://exchange.xforce.ibmcloud.com/vulnerabilities/11512XF