Lucene search

[email protected]CVE-2000-0867

HistoryNov 14, 2000 - 5:00 a.m.

CVE-2000-0867

2000-11-1405:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

linux

kernel

logging daemon

klogd

local users

root

privileges

cve-2000-0867

6.8 Medium

AI Score

Confidence

Low

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

51.9%

JSON

Kernel logging daemon (klogd) in Linux does not properly cleanse user-injected format strings, which allows local users to gain root privileges by triggering malformed kernel messages.

CPENameOperatorVersion
trustix:secure_linuxtrustix secure linuxeq1.1
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq7.0
redhat:linuxredhat linuxeq6.2
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq7.1
debian:debian_linuxdebian debian linuxeq2.1
redhat:linuxredhat linuxeq5.2
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq6.0
slackware:slackware_linuxslackware slackware linuxeq*
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq6.1
debian:debian_linuxdebian debian linuxeq2.2

CPE	Name	Operator	Version
trustix:secure_linux	trustix secure linux	eq	1.1
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	7.0
redhat:linux	redhat linux	eq	6.2
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	7.1
debian:debian_linux	debian debian linux	eq	2.1
redhat:linux	redhat linux	eq	5.2
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	6.0
slackware:slackware_linux	slackware slackware linux	eq	*
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	6.1
debian:debian_linux	debian debian linux	eq	2.2

References

ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2000-032.0.txt

archives.neohapsis.com/archives/bugtraq/2000-09/0193.html

frontal2.mandriva.com/security/advisories?name=MDKSA-2000:050

marc.info/?l=bugtraq&m=97726239017741&w=2

www.novell.com/linux/security/advisories/adv9_draht_syslogd_txt.html

www.osvdb.org/5824

www.redhat.com/support/errata/RHSA-2000-061.html

www.turbolinux.com/pipermail/tl-security-announce/2000-September/000023.html

exchange.xforce.ibmcloud.com/vulnerabilities/5259

6.8 Medium

AI Score

Confidence

Low

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

51.9%

JSON

Related for CVE-2000-0867

nessus1