CVE-2000-0844 Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettex...
HighCVSS 10.0
EPSS 15.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| caldera openlinux ebuilder | = 3.0 | No fix listed |
| immunix | = 6.2 | No fix listed |
| conectiva linux | = 4.0 | No fix listed |
| conectiva linux | = 4.0es | No fix listed |
| conectiva linux | = 4.1 | No fix listed |
| conectiva linux | = 4.2 | No fix listed |
| conectiva linux | = 5.0 | No fix listed |
| conectiva linux | = 5.1 | No fix listed |
| sgi irix | = 6.2 | No fix listed |
| sgi irix | = 6.3 | No fix listed |
| sgi irix | = 6.4 | No fix listed |
| sgi irix | = 6.5 | No fix listed |
| sgi irix | = 6.5.1 | No fix listed |
| sgi irix | = 6.5.2m | No fix listed |
| sgi irix | = 6.5.3 | No fix listed |
| sgi irix | = 6.5.3f | No fix listed |
| sgi irix | = 6.5.3m | No fix listed |
| sgi irix | = 6.5.4 | No fix listed |
| sgi irix | = 6.5.6 | No fix listed |
| sgi irix | = 6.5.7 | No fix listed |
| sgi irix | = 6.5.8 | No fix listed |
| caldera openlinux | All versions | No fix listed |
| caldera openlinux eserver | = 2.3 | No fix listed |
| debian linux | = 2.0 | No fix listed |
| debian linux | = 2.1 | No fix listed |
Show 49 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian linux | = 2.2 | No fix listed |
| debian linux | = 2.3 | No fix listed |
| ibm aix | = 3.2 | No fix listed |
| ibm aix | = 3.2.4 | No fix listed |
| ibm aix | = 3.2.5 | No fix listed |
| ibm aix | = 4.0 | No fix listed |
| ibm aix | = 4.1 | No fix listed |
| ibm aix | = 4.1.1 | No fix listed |
| ibm aix | = 4.1.2 | No fix listed |
| ibm aix | = 4.1.3 | No fix listed |
| ibm aix | = 4.1.4 | No fix listed |
| ibm aix | = 4.1.5 | No fix listed |
| ibm aix | = 4.2 | No fix listed |
| ibm aix | = 4.2.1 | No fix listed |
| ibm aix | = 4.3 | No fix listed |
| ibm aix | = 4.3.1 | No fix listed |
| ibm aix | = 4.3.2 | No fix listed |
| mandrakesoft mandrake linux | = 7.0 | No fix listed |
| mandrakesoft mandrake linux | = 7.1 | No fix listed |
| redhat linux | = 5.0 | No fix listed |
| redhat linux | = 5.1 | No fix listed |
| redhat linux | = 5.2 | No fix listed |
| redhat linux | = 6.0 | No fix listed |
| redhat linux | = 6.1 | No fix listed |
| redhat linux | = 6.2 | No fix listed |
| slackware linux | = 7.0 | No fix listed |
| slackware linux | = 7.1 | No fix listed |
| sun solaris | = 2.6 | No fix listed |
| sunos | = 5.0 | No fix listed |
| sunos | = 5.1 | No fix listed |
| sunos | = 5.2 | No fix listed |
| sunos | = 5.3 | No fix listed |
| sunos | = 5.4 | No fix listed |
| sunos | = 5.5 | No fix listed |
| sunos | = 5.5.1 | No fix listed |
| sunos | = 5.7 | No fix listed |
| sunos | = 5.8 | No fix listed |
| suse linux | = 6.1 | No fix listed |
| suse linux | = 6.2 | No fix listed |
| suse linux | = 6.3 | No fix listed |
| suse linux | = 6.4 | No fix listed |
| suse linux | = 7.0 | No fix listed |
| trustix secure linux | = 1.0 | No fix listed |
| trustix secure linux | = 1.1 | No fix listed |
| turbolinux | = 6.0 | No fix listed |
| turbolinux | = 6.0.1 | No fix listed |
| turbolinux | = 6.0.2 | No fix listed |
| turbolinux | = 6.0.3 | No fix listed |
| turbolinux | = 6.0.4 | No fix listed |
References
- 20000902 Conectiva Linux Security Announcement - glibc mailing-list
- 20000904 UNIX locale format string vulnerability exploit mailing-list patch vendor-advisory
- IY13753 vendor-advisory
- SSRT0689U vendor-advisory
- CSSA-2000-030.0 vendor-advisory
- 20000902 glibc: local root exploit vendor-advisory
- 20000906 glibc locale security problem vendor-advisory
- RHSA-2000:057 vendor-advisory
- 1634 exploit patch vdb-entry vendor-advisory
- TLSA2000020-1 vendor-advisory
- unix-locale-format-string(5176) vdb-entry