CVE-2002-1317

published 2002-12-11

CVE-2002-1317: Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or…

Priority P3 44 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.

Affected

34 ranges · showing 25

Vendor	Product	Version range	Fixed in
hp	hp-ux	—	—
hp	hp-ux	—	—
hp	hp-ux	—	—
hp	hp-ux	—	—
hp	hp-ux	—	—
hp	hp-ux	—	—
hp	hp-ux	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sgi	irix	—	—
sun	solaris	—	—
sun	solaris	—	—
sun	solaris	—	—
sun	solaris	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerable process is the XFS font server binary 'fs.auto'; monitor for crashes or unexpected execution under this process, particularly with remote connections. ↗
• → Successful exploitation results in code execution as user 'nobody'; alert on unexpected processes or shells spawned by the nobody user originating from the font server. ↗
• → The vulnerability is fixed in XFree86 3.3.6 and later; flag any systems running XFree86 font server versions prior to 3.3.6 as unpatched and at risk. ↗

• · The exploit code present in the source (DOC 2) is for a different vulnerability (ipppd local root / 7350pippi) and is unrelated to CVE-2002-1317; no operational IOCs for this CVE can be extracted from that exploit code. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.