CVE-2002-0175

libsafe 2.0-11 and earlier allows attackers to bypass protection against format string vulnerabilities via format strings that use the "'" and "I" characters, which are implemented in libc but not libsafe.

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://online.securityfocus.com/archive/1/263121	Exploit Patch Vendor Advisory
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-026.php	Patch Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0070.html
http://www.securityfocus.com/bid/4326
http://www.iss.net/security_center/static/8593.php

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:avaya:libsafe:2.0.11:::::::*
	cpe:2.3:a:avaya:libsafe:2.0.2:::::::*
	cpe:2.3:a:avaya:libsafe:2.0.5:::::::*
	cpe:2.3:a:avaya:libsafe:2.0.9:::::::*
	cpe:2.3:a:avaya:libsafe:1.3.8:::::::*
	cpe:2.3:a:avaya:libsafe:1.3.4:::::::*
	cpe:2.3:a:avaya:libsafe:2.0.10:::::::*

Information

Published : 2002-04-22 04:00

Updated : 2008-09-11 00:00

NVD link : CVE-2002-0175

Mitre link : CVE-2002-0175

JSON object : View

Products Affected

avaya

libsafe

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://online.securityfocus.com/archive/1/263121", "name": "20020320 Bypassing libsafe format string protection", "tags": ["Exploit", "Patch", "Vendor Advisory"], "refsource": "BUGTRAQ"}, {"url": "http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-026.php", "name": "MDKSA-2002:026", "tags": ["Patch", "Vendor Advisory"], "refsource": "MANDRAKE"}, {"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0070.html", "name": "20020320 [VulnWatch] Bypassing libsafe format string protection", "tags": [], "refsource": "VULNWATCH"}, {"url": "http://www.securityfocus.com/bid/4326", "name": "4326", "tags": [], "refsource": "BID"}, {"url": "http://www.iss.net/security_center/static/8593.php", "name": "libsafe-flagchar-protection-bypass(8593)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "libsafe 2.0-11 and earlier allows attackers to bypass protection against format string vulnerabilities via format strings that use the \"'\" and \"I\" characters, which are implemented in libc but not libsafe."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2002-0175", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2002-04-22T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:avaya:libsafe:2.0.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:avaya:libsafe:2.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:avaya:libsafe:2.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:avaya:libsafe:2.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:avaya:libsafe:1.3.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:avaya:libsafe:1.3.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:avaya:libsafe:2.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-11T00:00Z"}