Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2003-0102 — Improper Restriction of Operations within the Bounds of a Memory Buffer in File

9 documents8 sources
Severity
4.6MEDIUMNVD
EPSS
8.3%
top 7.74%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
File Project FileFileNetbsd
Timeline
PublishedMar 18
Latest updateMay 3

Description

Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages2 packages

▶Debianfile_project/file< 3.40-1.1+3
▶NVDfile/file10 versions+9

Also affects: Netbsd 1.5, 1.5.1, 1.5.2, 1.5.3, 1.6

Patches

Patch: www.idefense.com ↗Patch: www.securityfocus.com ↗Patch: www.idefense.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-8hj3-wvpv-xrpr: Buffer overflow in tryelf() in readelf↗2022-05-03
▶
CVEList
CVE-2003-0102: Buffer overflow in tryelf() in readelf↗2004-09-01
▶
OSV
CVE-2003-0102: Buffer overflow in tryelf() in readelf↗2003-03-18
▶

💥Exploits & PoCs

2
Exploit-DB
File 3.x - Local Stack Overflow Code Execution (2)↗2003-03-04
▶
Exploit-DB
File 3.x - Local Stack Overflow Code Execution (1)↗2003-03-04
▶

📋Vendor Advisories

2
Red Hat
security flaw↗2003-03-04
▶
Debian
CVE-2003-0102: file - Buffer overflow in tryelf() in readelf.c of the file command allows attackers to...↗2003
▶

💬Community

1
Bugzilla
CVE-2003-0102 security flaw↗2018-08-16
▶
CVE-2003-0102 — File vulnerability | cvebase