Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2002-1476

Overview

Vulnerability Score 4.6 4.6
CVE Id CVE-2002-1476
Last Modified 05 Sep 2008 04:30:42
Published 22 Apr 2003 12:00:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector LOCAL
Access Complexity LOW
Authentication NONE

CVE-2002-1476

Summary

Buffer overflow in setlocale in libc on NetBSD 1.4.x through 1.6, and possibly other operating systems, when called with the LC_ALL category, allows local attackers to execute arbitrary code via a user-controlled locale string that has more than 6 elements, which exceeds the boundaries of the new_categories category array, as exploitable through programs such as xterm and zsh.

Vulnerable Systems

Operating System

  • Netbsd 1.4

  • Netbsd 1.5

  • Netbsd 1.5.1

  • Netbsd 1.5.2

  • Netbsd 1.5.3

  • Netbsd 1.6


References

BID - 5724

XF - netbsd-libc-setlocale-bo(10159)

OSVDB - 7565

NETBSD - NetBSD-SA2002-012


Last Updated: 27 May 2016 10:37:20