Vulnerability Description
Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jeremy Elson | Tcpflow | 0.10 |
References
- http://www.atstake.com/research/advisories/2003/a080703-1.txtExploitPatchVendor Advisory
- http://www.atstake.com/research/advisories/2003/a080703-2.txt
- http://www.atstake.com/research/advisories/2003/a080703-1.txtExploitPatchVendor Advisory
- http://www.atstake.com/research/advisories/2003/a080703-2.txt
FAQ
What is CVE-2003-0671?
CVE-2003-0671 is a vulnerability with a CVSS score of 7.2 (HIGH). Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMon...
How severe is CVE-2003-0671?
CVE-2003-0671 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2003-0671?
Check the references section above for vendor advisories and patch information. Affected products include: Jeremy Elson Tcpflow.