CVE-2003-0102
published 2003-03-18CVE-2003-0102: Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity…
PriorityP418medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EXPLOIT
EPSS
1.98%
78.3th percentile
Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | file | < file 3.40-1.1 (bookworm) | file 3.40-1.1 (bookworm) |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file | file | — | — |
| file_project | file | >= 0 < 3.40-1.1 | 3.40-1.1 |
| file_project | file | >= 0 < 3.40-1.1 | 3.40-1.1 |
| file_project | file | >= 0 < 3.40-1.1 | 3.40-1.1 |
| file_project | file | >= 0 < 3.40-1.1 | 3.40-1.1 |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv4.6MEDIUM
vendor_debian4.6MEDIUM
vendor_redhat4.6MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8hj3-wvpv-xrpr: Buffer overflow in tryelf() in readelf
ghsa_unreviewed·2022-05-03
CVE-2003-0102 [MEDIUM] GHSA-8hj3-wvpv-xrpr: Buffer overflow in tryelf() in readelf
Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).
OSV
CVE-2003-0102: Buffer overflow in tryelf() in readelf
osv·2003-03-18·CVSS 4.6
CVE-2003-0102 [MEDIUM] CVE-2003-0102: Buffer overflow in tryelf() in readelf
Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).
Red Hat
security flaw
vendor_redhat·2003-03-04·CVSS 4.6
CVE-2003-0102 [MEDIUM] security flaw
security flaw
Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).
Debian
CVE-2003-0102: file - Buffer overflow in tryelf() in readelf.c of the file command allows attackers to...
vendor_debian·2003·CVSS 4.6
CVE-2003-0102 [MEDIUM] CVE-2003-0102: file - Buffer overflow in tryelf() in readelf.c of the file command allows attackers to...
Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).
Scope: local
bookworm: resolved (fixed in 3.40-1.1)
bullseye: resolved (fixed in 3.40-1.1)
forky: resolved (fixed in 3.40-1.1)
sid: resolved (fixed in 3.40-1.1)
trixie: resolved (fixed in 3.40-1.1)
No detection rules found.
Exploit-DB
File 3.x - Local Stack Overflow Code Execution (2)
exploitdb·2003-03-04
CVE-2003-0102 File 3.x - Local Stack Overflow Code Execution (2)
File 3.x - Local Stack Overflow Code Execution (2)
---
// source: https://www.securityfocus.com/bid/7008/info
It has been reported that a stack overflow exists in the file program. Although details of this issue are currently unavailable, it is likely that this issue could be exploited to execute code as the user invoking file.
/*
** file(1) exploit for *bsd,linux
** does cp /bin/sh /tmp/.sh;chmod 4755 /tmp/.sh and also
** echos the correct filename followed by ": data"
** this one actually works w/o silly targets or offsets
** cmdshellcode by *://lsd-pl.net/
** [email protected]
*/
#include
#include
#include
#include
#include
/* elf stuff */
#define EI_NIDENT 16
#define ET_EXEC 2
#define EM_VPP500 17/* Fujitsu VPP500! */
#define EV_CURRENT 1
#define FILESIZE 16384
typedef unsigned s
Exploit-DB
File 3.x - Local Stack Overflow Code Execution (1)
exploitdb·2003-03-04
CVE-2003-0102 File 3.x - Local Stack Overflow Code Execution (1)
File 3.x - Local Stack Overflow Code Execution (1)
---
// source: https://www.securityfocus.com/bid/7008/info
It has been reported that a stack overflow exists in the file program. Although details of this issue are currently unavailable, it is likely that this issue could be exploited to execute code as the user invoking file.
/*
** elfrape BY lem0n ([email protected])
** a glorified stack overflow in file.
**
** a glorified stack overflow in file
**
** Note: may not work if used on files less than 8k or so.
*/
#include
#include
#include
#include
#include
#define MAX_FILENAME 17/* the longest filename i suggest you use */
#define SHELL "/bin/ash"/* a shell that doesnt do seteuid(getuid()); ash,ksh,zsh,etc */
#define LANDING_SIZE 8192/* pretty big considering its just nops and shellc
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-003.txt.aschttp://lwn.net/Alerts/34908/http://marc.info/?l=bugtraq&m=104680706201721&w=2http://www.debian.org/security/2003/dsa-260http://www.idefense.com/advisory/03.04.03.txthttp://www.kb.cert.org/vuls/id/611865http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:030http://www.novell.com/linux/security/advisories/2003_017_file.htmlhttp://www.redhat.com/support/errata/RHSA-2003-086.htmlhttp://www.redhat.com/support/errata/RHSA-2003-087.htmlhttp://www.securityfocus.com/bid/7008https://exchange.xforce.ibmcloud.com/vulnerabilities/11469ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-003.txt.aschttp://lwn.net/Alerts/34908/http://marc.info/?l=bugtraq&m=104680706201721&w=2http://www.debian.org/security/2003/dsa-260http://www.idefense.com/advisory/03.04.03.txthttp://www.kb.cert.org/vuls/id/611865http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:030http://www.novell.com/linux/security/advisories/2003_017_file.htmlhttp://www.redhat.com/support/errata/RHSA-2003-086.htmlhttp://www.redhat.com/support/errata/RHSA-2003-087.htmlhttp://www.securityfocus.com/bid/7008https://exchange.xforce.ibmcloud.com/vulnerabilities/11469
2003-03-18
Published