CVE-2003-0584 Format string vulnerability in Backup and Restore Utility for Unix (BRU) 17.0 and earlier, when running setuid, allows local users to execute arbitrary code via format string specifiers in a command l...

HighCVSS 7.2 EPSS 1.1% Public exploit

Published: 2016-10-17 07:00
Updated: 2026-06-17 01:02
Exploit status: Public exploit available

Description

Format string vulnerability in Backup and Restore Utility for Unix (BRU) 17.0 and earlier, when running setuid, allows local users to execute arbitrary code via format string specifiers in a command line argument.

Affected products

Product	Affected versions	Fixed in
tolis group bru	<= 17.0	No fix listed

References

20030716 SRT2003-07-16-0358 - bru has buffer overflow and format issues mailing-list

CVSS v2.0

7.2 High

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: Local
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.06% (percentile 65.1)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Tolis Group BRU 17.0 - Local Privilege Escalation (2) Exploit · Exploit Database (OffSec) · 2003-07-16
Tolis Group BRU 17.0 - Local Privilege Escalation (1) Exploit · Exploit Database (OffSec) · 2003-07-16