Vulnerabilities > CVE-2003-0805 - Unspecified vulnerability in University of Minnesota Gopherd

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
university-of-minnesota
nessus
exploit available
NVD
Published: 2003-10-06
Updated: 2016-10-18

Summary

Multiple buffer overflows in UMN gopher daemon (gopherd) 2.x and 3.x before 3.0.6 allows attackers to execute arbitrary code via (1) a long filename as a result of a LIST command, and (2) the GSisText function, which calculates the view-type.

Vulnerable Configurations

Part Description Count
Application
University_Of_Minnesota
10

Exploit-Db

  • descriptionUniversity of Minnesota Gopherd 2.0.x/2.3/3.0.x GSisText Buffer Overflow Vulnerability. CVE-2003-0805. Remote exploit for linux platform
    idEDB-ID:22894
    last seen2016-02-02
    modified2003-07-11
    published2003-07-11
    reporterV9
    sourcehttps://www.exploit-db.com/download/22894/
    titleUniversity of Minnesota Gopherd 2.0.x/2.3/3.0.x GSisText Buffer Overflow Vulnerability
  • descriptionUniversity of Minnesota Gopherd 2.0.x/2.3/3.0.x FTP Gateway Buffer Overflow Vulnerability. CVE-2003-0805. Remote exploit for linux platform
    idEDB-ID:22893
    last seen2016-02-02
    modified2003-07-11
    published2003-07-11
    reporterV9
    sourcehttps://www.exploit-db.com/download/22893/
    titleUniversity of Minnesota Gopherd 2.0.x/2.3/3.0.x FTP Gateway Buffer Overflow Vulnerability

Nessus

NASL familyDebian Local Security Checks
NASL idDEBIAN_DSA-387.NASL
descriptiongopherd, a gopher server from the University of Minnesota, contains a number of buffer overflows which could be exploited by a remote attacker to execute arbitrary code with the privileges of the gopherd process (the
last seen2020-06-01
modified2020-06-02
plugin id15224
published2004-09-29
reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/15224
titleDebian DSA-387-1 : gopher - buffer overflows
code
#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-387. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(15224);
  script_version("1.18");
  script_cvs_date("Date: 2019/08/02 13:32:17");

  script_cve_id("CVE-2003-0805");
  script_bugtraq_id(8167, 8168, 8283);
  script_xref(name:"DSA", value:"387");

  script_name(english:"Debian DSA-387-1 : gopher - buffer overflows");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"gopherd, a gopher server from the University of Minnesota, contains a
number of buffer overflows which could be exploited by a remote
attacker to execute arbitrary code with the privileges of the gopherd
process (the 'gopher' user by default)."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2003/dsa-387"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"For the stable distribution (woody) this problem has been fixed in
version 3.0.3woody1.

This program has been removed from the unstable distribution (sid).
gopherd is deprecated, and users are recommended to use PyGopherd
instead.

We recommend that you update your gopherd package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gopher");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2003/09/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"3.0", prefix:"gopher", reference:"3.0.3woody1")) flag++;
if (deb_check(release:"3.0", prefix:"gopherd", reference:"3.0.3woody1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

References