CVE-2002-0525

Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2002-04/0140.html
http://www.iss.net/security_center/static/8834.php	Vendor Advisory
http://www.securityfocus.com/bid/4501	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:isc:inn:2.0:::::::*
	cpe:2.3:a:isc:inn:2.1:::::::*
	cpe:2.3:a:isc:inn:2.2:::::::*
	cpe:2.3:a:isc:inn:2.2.1:::::::*
	cpe:2.3:a:isc:inn:2.2.2:::::::*
	cpe:2.3:a:isc:inn:2.2.3:::::::*

History

No history.

Information

Published : 2002-08-12 04:00

Updated : 2024-02-28 10:24

NVD link : CVE-2002-0525

Mitre link : CVE-2002-0525

CVE.ORG link : CVE-2002-0525

JSON object : View

Products Affected

isc

inn

CWE

NVD-CWE-Other

{"id": "CVE-2002-0525", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2002-08-12T04:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2002-04/0140.html", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/8834.php", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/4501", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses."}], "lastModified": "2008-09-05T20:28:15.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:isc:inn:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2480B45-A626-49F5-A48B-BA6DFAA4411B"}, {"criteria": "cpe:2.3:a:isc:inn:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21969A37-9F10-4D70-AC73-F3DB4D169AEB"}, {"criteria": "cpe:2.3:a:isc:inn:2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94FD2948-EF52-464B-A605-DA3806037762"}, {"criteria": "cpe:2.3:a:isc:inn:2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CC41E6D-B892-4888-8AEE-12287935F570"}, {"criteria": "cpe:2.3:a:isc:inn:2.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DED2B74-71B6-467C-8B07-F6F728AD7BF4"}, {"criteria": "cpe:2.3:a:isc:inn:2.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "862E58CF-7194-421D-9E7D-60DB8AA1F9CB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}