DATABASE RESOURCES PRICING ABOUT US

{"id": "OSV:DSA-156", "bulletinFamily": "software", "title": "epic4-script-light - arbitrary script execution", "description": "\nAll versions of the EPIC script Light prior to 2.7.30p5 (on the 2.7\nbranch) and prior to 2.8pre10 (on the 2.8 branch) running on any\nplatform are vulnerable to a remotely-exploitable bug, which can lead\nto nearly arbitrary code execution.\n\n\nThis problem has been fixed in version 2.7.30p5-1.1 for the current\nstable distribution (woody) and in version 2.7.30p5-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the Light package.\n\n\nWe recommend that you upgrade your epic4-script-light package and\nrestart your IRC client.\n\n\n", "published": "2002-08-22T00:00:00", "modified": "2014-04-29T17:19:40", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "href": "https://osv.dev/vulnerability/DSA-156", "reporter": "Google", "references": ["https://www.debian.org/security/2002/dsa-156"], "cvelist": ["CVE-2002-0984"], "immutableFields": [], "type": "osv", "lastseen": "2022-07-12T05:40:23", "edition": 1, "viewCount": 3, "enchantments": {"dependencies": {"references": [{"idList": ["DEBIAN_DSA-156.NASL"], "type": "nessus"}, {"idList": ["CVE-2002-0984"], "type": "cve"}, {"idList": ["OPENVAS:53414"], "type": "openvas"}]}, "score": {"value": 2.8, "vector": "NONE"}, "affected_software": {"major_version": []}, "epss": [{"cve": "CVE-2002-0984", "epss": "0.026380000", "percentile": "0.886960000", "modified": "2023-03-20"}], "vulnersScore": 2.8}, "_state": {"score": 1684016453, "dependencies": 1660016946, "affected_software_major_version": 1666703109, "epss": 1679334401}, "_internal": {"score_hash": "5921e00c9907dd88856fa8e06acb007a"}, "affectedSoftware": []}

{"openvas": [{"lastseen": "2017-07-24T12:50:07", "description": "The remote host is missing an update to epic4-script-light\nannounced via advisory DSA 156-1.", "cvss3": {}, "published": "2008-01-17T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 156-1 (epic4-script-light)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2002-0984"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:53414", "href": "http://plugins.openvas.org/nasl.php?oid=53414", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_156_1.nasl 6616 2017-07-07 12:10:49Z cfischer $\n# Description: Auto-generated from advisory DSA 156-1\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largerly excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"All versions of the EPIC script Light prior to 2.7.30p5 (on the 2.7\nbranch) and prior to 2.8pre10 (on the 2.8 branch) running on any\nplatform are vulnerable to a remotely-exploitable bug, which can lead\nto nearly arbitrary code execution.\n\nThis problem has been fixed in version 2.7.30p5-1.1 for the current\nstable distribution (woody) and in version 2.7.30p5-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the Light package.\n\nWe recommend that you upgrade your epic4-script-light package and\";\ntag_summary = \"The remote host is missing an update to epic4-script-light\nannounced via advisory DSA 156-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20156-1\";\n\nif(description)\n{\n script_id(53414);\n script_version(\"$Revision: 6616 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:10:49 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-01-17 22:24:46 +0100 (Thu, 17 Jan 2008)\");\n script_cve_id(\"CVE-2002-0984\");\n script_bugtraq_id(5555);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Debian Security Advisory DSA 156-1 (epic4-script-light)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"epic4-script-light\", ver:\"2.7.30p5-1.1\", rls:\"DEB3.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2023-05-18T14:24:20", "description": "All versions of the EPIC script Light prior to 2.7.30p5 (on the 2.7 branch) and prior to 2.8pre10 (on the 2.8 branch) running on any platform are vulnerable to a remotely-exploitable bug, which can lead to nearly arbitrary code execution.", "cvss3": {}, "published": "2004-09-29T00:00:00", "type": "nessus", "title": "Debian DSA-156-1 : epic4-script-light - arbitrary script execution", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2002-0984"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:epic4-script-light", "cpe:/o:debian:debian_linux:3.0"], "id": "DEBIAN_DSA-156.NASL", "href": "https://www.tenable.com/plugins/nessus/14993", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-156. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(14993);\n script_version(\"1.20\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2002-0984\");\n script_bugtraq_id(5555);\n script_xref(name:\"DSA\", value:\"156\");\n\n script_name(english:\"Debian DSA-156-1 : epic4-script-light - arbitrary script execution\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"All versions of the EPIC script Light prior to 2.7.30p5 (on the 2.7\nbranch) and prior to 2.8pre10 (on the 2.8 branch) running on any\nplatform are vulnerable to a remotely-exploitable bug, which can lead\nto nearly arbitrary code execution.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2002/dsa-156\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the epic4-script-light package and restart the IRC client.\n\nThis problem has been fixed in version 2.7.30p5-1.1 for the current\nstable distribution (woody) and in version 2.7.30p5-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the Light package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:epic4-script-light\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:3.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/08/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2004/09/29\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2004/04/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2004-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"3.0\", prefix:\"epic4-script-light\", reference:\"2.7.30p5-1.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "cve": [{"lastseen": "2023-06-04T14:16:46", "description": "The IRC script included in Light 2.7.x before 2.7.30p5, and 2.8.x before 2.8pre10, running EPIC allows remote attackers to execute arbitrary code if the user joins a channel whose topic includes EPIC4 code.", "cvss3": {}, "published": "2002-09-24T04:00:00", "type": "cve", "title": "CVE-2002-0984", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2002-0984"], "modified": "2008-09-10T19:13:00", "cpe": ["cpe:/a:light:light:2.8_pre9", "cpe:/a:light:light:2.7.30p4"], "id": "CVE-2002-0984", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0984", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:light:light:2.7.30p4:*:*:*:*:*:*:*", "cpe:2.3:a:light:light:2.8_pre9:*:*:*:*:*:*:*"]}]}