Published: 18/03/2003 Updated: 03/05/2018

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 470

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Buffer overflow in tryelf() in readelf.c of the file command allows malicious users to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).

Vulnerable Product	Search on Vulmon	Subscribe to Product
file file 3.30
file file 3.32
file file 3.28
file file 3.37
file file 3.39
file file 3.40
file file 3.33
file file 3.34
file file 3.35
file file 3.36
netbsd netbsd 1.5
netbsd netbsd 1.5.1
netbsd netbsd 1.5.2
netbsd netbsd 1.5.3
netbsd netbsd 1.6

iDEFENSE discovered a buffer overflow vulnerability in the ELF format parsing of the "file" command, one which can be used to execute arbitrary code with the privileges of the user running the command The vulnerability can be exploited by crafting a special ELF binary which is then input to file This could be accomplished by leaving the binary on ...

source: wwwsecurityfocuscom/bid/7008/info It has been reported that a stack overflow exists in the file program Although details of this issue are currently unavailable, it is likely that this issue could be exploited to execute code as the user invoking file /* ** file(1) exploit for *bsd,linux ** does cp /bin/sh /tmp/sh;chmod 4755 ...

source: wwwsecurityfocuscom/bid/7008/info It has been reported that a stack overflow exists in the file program Although details of this issue are currently unavailable, it is likely that this issue could be exploited to execute code as the user invoking file /* ** elfrape BY lem0n (lem0nxx@hotmailcom) ** a glorified stack overflow i ...

NVD-CWE-Other http://www.idefense.com/advisory/03.04.03.txt http://www.securityfocus.com/bid/7008 http://www.debian.org/security/2003/dsa-260 http://lwn.net/Alerts/34908/http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:030 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-003.txt.asc http://www.novell.com/linux/security/advisories/2003_017_file.html http://www.redhat.com/support/errata/RHSA-2003-086.html http://www.redhat.com/support/errata/RHSA-2003-087.html http://www.kb.cert.org/vuls/id/611865 http://marc.info/?l=bugtraq&m=104680706201721&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/11469 https://nvd.nist.gov https://www.debian.org/security/./dsa-260 https://www.exploit-db.com/exploits/22325/

CVE-2003-0102

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect