CVE-2003-0028 Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allo...
HighCVSS 7.5
EPSS 15.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU glibc | = 2.1 | No fix listed |
| GNU glibc | = 2.1.1 | No fix listed |
| GNU glibc | = 2.1.2 | No fix listed |
| GNU glibc | = 2.1.3 | No fix listed |
| GNU glibc | = 2.2 | No fix listed |
| GNU glibc | = 2.2.1 | No fix listed |
| GNU glibc | = 2.2.2 | No fix listed |
| GNU glibc | = 2.2.3 | No fix listed |
| GNU glibc | = 2.2.4 | No fix listed |
| GNU glibc | = 2.2.5 | No fix listed |
| GNU glibc | = 2.3 | No fix listed |
| GNU glibc | = 2.3.1 | No fix listed |
| GNU glibc | = 2.3.2 | No fix listed |
| mit kerberos 5 | = 1.2 | No fix listed |
| mit kerberos 5 | = 1.2.1 | No fix listed |
| mit kerberos 5 | = 1.2.2 | No fix listed |
| mit kerberos 5 | = 1.2.3 | No fix listed |
| mit kerberos 5 | = 1.2.4 | No fix listed |
| mit kerberos 5 | = 1.2.5 | No fix listed |
| mit kerberos 5 | = 1.2.6 | No fix listed |
| mit kerberos 5 | = 1.2.7 | No fix listed |
| openafs | = 1.0 | No fix listed |
| openafs | = 1.0.1 | No fix listed |
| openafs | = 1.0.2 | No fix listed |
| openafs | = 1.0.3 | No fix listed |
Show 148 more
| Product | Affected versions | Fixed in |
|---|---|---|
| openafs | = 1.0.4 | No fix listed |
| openafs | = 1.0.4a | No fix listed |
| openafs | = 1.1 | No fix listed |
| openafs | = 1.1.1 | No fix listed |
| openafs | = 1.1.1a | No fix listed |
| openafs | = 1.2 | No fix listed |
| openafs | = 1.2.1 | No fix listed |
| openafs | = 1.2.2 | No fix listed |
| openafs | = 1.2.2a | No fix listed |
| openafs | = 1.2.2b | No fix listed |
| openafs | = 1.2.3 | No fix listed |
| openafs | = 1.2.4 | No fix listed |
| openafs | = 1.2.5 | No fix listed |
| openafs | = 1.2.6 | No fix listed |
| openafs | = 1.3 | No fix listed |
| openafs | = 1.3.1 | No fix listed |
| openafs | = 1.3.2 | No fix listed |
| sgi irix | = 6.5 | No fix listed |
| sgi irix | = 6.5.1 | No fix listed |
| sgi irix | = 6.5.2 | No fix listed |
| sgi irix | = 6.5.2f | No fix listed |
| sgi irix | = 6.5.2m | No fix listed |
| sgi irix | = 6.5.3 | No fix listed |
| sgi irix | = 6.5.3f | No fix listed |
| sgi irix | = 6.5.3m | No fix listed |
| sgi irix | = 6.5.4 | No fix listed |
| sgi irix | = 6.5.4f | No fix listed |
| sgi irix | = 6.5.4m | No fix listed |
| sgi irix | = 6.5.5 | No fix listed |
| sgi irix | = 6.5.5f | No fix listed |
| sgi irix | = 6.5.5m | No fix listed |
| sgi irix | = 6.5.6 | No fix listed |
| sgi irix | = 6.5.6f | No fix listed |
| sgi irix | = 6.5.6m | No fix listed |
| sgi irix | = 6.5.7 | No fix listed |
| sgi irix | = 6.5.7f | No fix listed |
| sgi irix | = 6.5.7m | No fix listed |
| sgi irix | = 6.5.8 | No fix listed |
| sgi irix | = 6.5.8f | No fix listed |
| sgi irix | = 6.5.8m | No fix listed |
| sgi irix | = 6.5.9 | No fix listed |
| sgi irix | = 6.5.9f | No fix listed |
| sgi irix | = 6.5.9m | No fix listed |
| sgi irix | = 6.5.10 | No fix listed |
| sgi irix | = 6.5.10f | No fix listed |
| sgi irix | = 6.5.10m | No fix listed |
| sgi irix | = 6.5.11 | No fix listed |
| sgi irix | = 6.5.11f | No fix listed |
| sgi irix | = 6.5.11m | No fix listed |
| sgi irix | = 6.5.12 | No fix listed |
| sgi irix | = 6.5.12f | No fix listed |
| sgi irix | = 6.5.12m | No fix listed |
| sgi irix | = 6.5.13 | No fix listed |
| sgi irix | = 6.5.13f | No fix listed |
| sgi irix | = 6.5.13m | No fix listed |
| sgi irix | = 6.5.14 | No fix listed |
| sgi irix | = 6.5.14f | No fix listed |
| sgi irix | = 6.5.14m | No fix listed |
| sgi irix | = 6.5.15 | No fix listed |
| sgi irix | = 6.5.15f | No fix listed |
| sgi irix | = 6.5.15m | No fix listed |
| sgi irix | = 6.5.16 | No fix listed |
| sgi irix | = 6.5.16f | No fix listed |
| sgi irix | = 6.5.16m | No fix listed |
| sgi irix | = 6.5.17 | No fix listed |
| sgi irix | = 6.5.17f | No fix listed |
| sgi irix | = 6.5.17m | No fix listed |
| sgi irix | = 6.5.18 | No fix listed |
| sgi irix | = 6.5.18f | No fix listed |
| sgi irix | = 6.5.18m | No fix listed |
| sgi irix | = 6.5.19 | No fix listed |
| sgi irix | = 6.5.20 | No fix listed |
| cray unicos | = 6.0 | No fix listed |
| cray unicos | = 6.0e | No fix listed |
| cray unicos | = 6.1 | No fix listed |
| cray unicos | = 7.0 | No fix listed |
| cray unicos | = 8.0 | No fix listed |
| cray unicos | = 8.3 | No fix listed |
| cray unicos | = 9.0 | No fix listed |
| cray unicos | = 9.0.2.5 | No fix listed |
| cray unicos | = 9.2 | No fix listed |
| cray unicos | = 9.2.4 | No fix listed |
| freebsd | = 4.0 | No fix listed |
| freebsd | = 4.1 | No fix listed |
| freebsd | = 4.1.1 | No fix listed |
| freebsd | = 4.1.1-release | No fix listed |
| freebsd | = 4.1.1-stable | No fix listed |
| freebsd | = 4.2 | No fix listed |
| freebsd | = 4.2-stable | No fix listed |
| freebsd | = 4.3 | No fix listed |
| freebsd | = 4.3-release | No fix listed |
| freebsd | = 4.3-stable | No fix listed |
| freebsd | = 4.4 | No fix listed |
| freebsd | = 4.4-stable | No fix listed |
| freebsd | = 4.5 | No fix listed |
| freebsd | = 4.5-release | No fix listed |
| freebsd | = 4.5-stable | No fix listed |
| freebsd | = 4.6 | No fix listed |
| freebsd | = 4.6-release | No fix listed |
| freebsd | = 4.6-stable | No fix listed |
| freebsd | = 4.6.2 | No fix listed |
| freebsd | = 4.7 | No fix listed |
| freebsd | = 4.7-release | No fix listed |
| freebsd | = 4.7-stable | No fix listed |
| freebsd | = 5.0 | No fix listed |
| HP Inc hp-ux | = 10.20 | No fix listed |
| HP Inc hp-ux | = 10.24 | No fix listed |
| HP Inc hp-ux | = 11.00 | No fix listed |
| HP Inc hp-ux | = 11.04 | No fix listed |
| HP Inc hp-ux | = 11.11 | No fix listed |
| HP Inc hp-ux | = 11.20 | No fix listed |
| HP Inc hp-ux | = 11.22 | No fix listed |
| HP Inc hp-ux series 700 | = 10.20 | No fix listed |
| HP Inc hp-ux series 800 | = 10.20 | No fix listed |
| ibm aix | = 4.3.3 | No fix listed |
| ibm aix | = 5.1 | No fix listed |
| ibm aix | = 5.2 | No fix listed |
| OpenBSD | = 2.0 | No fix listed |
| OpenBSD | = 2.1 | No fix listed |
| OpenBSD | = 2.2 | No fix listed |
| OpenBSD | = 2.3 | No fix listed |
| OpenBSD | = 2.4 | No fix listed |
| OpenBSD | = 2.5 | No fix listed |
| OpenBSD | = 2.6 | No fix listed |
| OpenBSD | = 2.7 | No fix listed |
| OpenBSD | = 2.8 | No fix listed |
| OpenBSD | = 2.9 | No fix listed |
| OpenBSD | = 3.0 | No fix listed |
| OpenBSD | = 3.1 | No fix listed |
| OpenBSD | = 3.2 | No fix listed |
| sun solaris | = 2.5.1 | No fix listed |
| sun solaris | = 2.6 | No fix listed |
| sun solaris | = 7.0 | No fix listed |
| sun solaris | = 8.0 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
| sunos | All versions | No fix listed |
| sunos | = 5.5.1 | No fix listed |
| sunos | = 5.7 | No fix listed |
| sunos | = 5.8 | No fix listed |
| debian/dietlibc(Debian:12) | < 0.22-2 | 0.22-2 |
| debian/dietlibc(Debian:13) | < 0.22-2 | 0.22-2 |
| debian/dietlibc(Debian:14) | < 0.22-2 | 0.22-2 |
| debian/glibc(Debian:12) | < 2.3.1-16 | 2.3.1-16 |
| debian/glibc(Debian:13) | < 2.3.1-16 | 2.3.1-16 |
| debian/glibc(Debian:14) | < 2.3.1-16 | 2.3.1-16 |
| debian/krb5(Debian:12) | < 1.3.3-2 | 1.3.3-2 |
| debian/krb5(Debian:13) | < 1.3.3-2 | 1.3.3-2 |
| debian/krb5(Debian:14) | < 1.3.3-2 | 1.3.3-2 |
References
- 20030319 EEYE: XDR Integer Overflow mailing-list
- 20030319 EEYE: XDR Integer Overflow mailing-list
- 20030319 MITKRB5-SA-2003-003: faulty length checks in xdrmem_getbytes mailing-list
- 20030325 GLSA: glibc (200303-22) mailing-list
- 2003-0014 vendor-advisory
- 20030522 [slackware-security] glibc XDR overflow fix (SSA:2003-141-03) mailing-list
- CA-2003-10 patch third-party-advisory us-government-resource
- DSA-266 vendor-advisory
- DSA-272 vendor-advisory
- DSA-282 vendor-advisory
- AD20030318 exploit third-party-advisory vendor-advisory
- VU#516825 third-party-advisory us-government-resource
- ESA-20030321-010 vendor-advisory
- MDKSA-2003:037 vendor-advisory
- SuSE-SA:2003:027 vendor-advisory
- RHSA-2003:051 vendor-advisory
- RHSA-2003:052 vendor-advisory
- RHSA-2003:089 vendor-advisory
- RHSA-2003:091 vendor-advisory
- 20030319 RE: EEYE: XDR Integer Overflow mailing-list
- 20030331 GLSA: dietlibc (200303-29) mailing-list
- 20030331 GLSA: krb5 & mit-krb5 (200303-28) mailing-list
- oval:org.mitre.oval:def:230 signature vdb-entry
- security.netapp.com
- Debian Security Tracker CVE-2003-0028 vendor-advisory