Vulnerability-Lookup

CERTA-2002-AVI-277

Vulnerability from certfr_avis - Published: 2002-12-20 - Updated: 2002-12-20

Une vulnérabilité de UW-Imapd permet à un utilisateur local mal intentionné d'élever ses privilèges.

Description

UW-Imapd est un serveur de récupération des messages réalisé par l'Université de Washington.

Une vulnérabilité de type débordement de mémoire permet à un utilisateur local mal intentionné, qui s'est préalablement authentifié sur le serveur, d'élever ses privilèges.

Solution

Installer la version imap-2002a disponible à l'adresse :

http://www.washington.edu/imap/imap.tar.Z

Versions de UW-Imapd antérieures à la version imap-2002a.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Note de vulnérabilité VU#961489 du CERT/CC

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eVersions de UW-Imapd ant\u00e9rieures \u00e0 la version imap-2002a.\u003c/P\u003e",
  "content": "## Description\n\nUW-Imapd est un serveur de r\u00e9cup\u00e9ration des messages r\u00e9alis\u00e9 par\nl\u0027Universit\u00e9 de Washington.\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire permet \u00e0 un utilisateur\nlocal mal intentionn\u00e9, qui s\u0027est pr\u00e9alablement authentifi\u00e9 sur le\nserveur, d\u0027\u00e9lever ses privil\u00e8ges.\n\n## Solution\n\nInstaller la version imap-2002a disponible \u00e0 l\u0027adresse :\n\n    http://www.washington.edu/imap/imap.tar.Z\n",
  "cves": [],
  "initial_release_date": "2002-12-20T00:00:00",
  "last_revision_date": "2002-12-20T00:00:00",
  "links": [],
  "reference": "CERTA-2002-AVI-277",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-12-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 de UW-Imapd permet \u00e0 un utilisateur local mal\nintentionn\u00e9 d\u0027\u00e9lever ses privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de UW-Imapd",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Note de vuln\u00e9rabilit\u00e9 VU#961489 du CERT/CC",
      "url": "http://www.kb.cert.org/vuls/id/961489"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted