Vulnerabilities > CVE-2003-0035 - Local Printer Name Buffer Overflow vulnerability in Robert Krawitz Escputil 1.15.2.2
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Buffer overflow in escputil, as included in the printer-drivers package in Mandrake Linux, allows local users to execute arbitrary code via a long printer-name command line argument.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Nessus
| NASL family | Mandriva Local Security Checks |
| NASL id | MANDRAKE_MDKSA-2003-010.NASL |
| description | Karol Wiesek and iDefense disovered three vulnerabilities in the printer-drivers package and tools it installs. These vulnerabilities allow a local attacker to empty or create any file on the filesystem. The first vulnerability is in the mtink binary, which has a buffer overflow in its handling of the HOME environment variable. The second vulnerability is in the escputil binary, which has a buffer overflow in the parsing of the --printer-name command line argument. This is only possible when esputil is suid or sgid; in Mandrake Linux 9.0 it was sgid |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 13995 |
| published | 2004-07-31 |
| reporter | This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/13995 |
| title | Mandrake Linux Security Advisory : printer-drivers (MDKSA-2003:010) |
References
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0029.html
- http://www.idefense.com/advisory/01.21.03.txt
- http://www.mandriva.com/security/advisories?name=MDKSA-2003:010
- http://www.securityfocus.com/archive/1/307608/30/26270/threaded
- http://www.securityfocus.com/bid/6658
- http://www.securitytracker.com/id?1005959