CVE-2003-0021

The "screen dump" feature in Eterm 0.9.1 and earlier allows attackers to overwrite arbitrary files via a certain character escape sequence when it is echoed to a user's terminal, e.g. when the user views a file containing the malicious sequence.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html	Vendor Advisory
http://marc.info/?l=bugtraq&m=104612710031920&w=2
http://www.iss.net/security_center/static/11413.php	Vendor Advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:040
http://www.securityfocus.com/bid/6936

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:michael_jennings:eterm:0.8.10:::::::*
	cpe:2.3:a:michael_jennings:eterm:0.9.1:::::::*

History

No history.

Information

Published : 2003-03-03 05:00

Updated : 2016-10-18 02:28

NVD link : CVE-2003-0021

Mitre link : CVE-2003-0021

CVE.ORG link : CVE-2003-0021

JSON object : View

Products Affected

michael_jennings

eterm

CWE

NVD-CWE-Other

{"id": "CVE-2003-0021", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2003-03-03T05:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=104612710031920&w=2", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/11413.php", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:040", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/6936", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The \"screen dump\" feature in Eterm 0.9.1 and earlier allows attackers to overwrite arbitrary files via a certain character escape sequence when it is echoed to a user's terminal, e.g. when the user views a file containing the malicious sequence."}, {"lang": "es", "value": "La caracter\u00edstica \"volcado de pantalla\" en Eterm 0.9.1 y anteriores permite a atacantes sobreescribir ficheros arbitrarios mediante una cierta secuencia de escape de caracteres cuando hacen eco en el terminal de un usuario, por ejemplo, cuando el usuario ve un fichero conteniendo la secuencia maliciosa."}], "lastModified": "2016-10-18T02:28:25.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:michael_jennings:eterm:0.8.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B33FE201-759E-4EE4-B19E-A25E6FBD711B"}, {"criteria": "cpe:2.3:a:michael_jennings:eterm:0.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DD5D189-F36C-4E49-92C0-72C9D72A43BA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}