Lucene search
MitreCVE-2003-0671HistoryAug 27, 2003 - 4:00 a.m.
CVE-2003-0671
2003-08-2704:00:00
mitre
web.nvd.nist.gov
30
cve-2003-0671
tcpflow
format string vulnerability
local execution
arbitrary code
device name argument
sustworks ipnetsentryx
ipnetmonitorx
nvd
CVSS2
7.2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
AI Score
7.6
Confidence
High
EPSS
0
Percentile
0.4%
Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow.
Affected configurations
Node
jeremy_elsontcpflowMatch0.10
ORjeremy_elsontcpflowMatch0.11
ORjeremy_elsontcpflowMatch0.12
ORjeremy_elsontcpflowMatch0.20
| Vendor | Product | Version | CPE |
|---|---|---|---|
| jeremy_elson | tcpflow | 0.10 | cpe:2.3:a:jeremy_elson:tcpflow:0.10:*:*:*:*:*:*:* |
| jeremy_elson | tcpflow | 0.11 | cpe:2.3:a:jeremy_elson:tcpflow:0.11:*:*:*:*:*:*:* |
| jeremy_elson | tcpflow | 0.12 | cpe:2.3:a:jeremy_elson:tcpflow:0.12:*:*:*:*:*:*:* |
| jeremy_elson | tcpflow | 0.20 | cpe:2.3:a:jeremy_elson:tcpflow:0.20:*:*:*:*:*:*:* |
CVSS2
7.2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
AI Score
7.6
Confidence
High
EPSS
0
Percentile
0.4%
Related for CVE-2003-0671