Quantum Secular Labs / Blog / Advisories

CVE-2001-0191: Andynorman Gnuserv: Command injection

CVE-2001-0191 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Andynorman Gnuserv. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

gnuserv before 3.12, as shipped with XEmacs, does not properly check the specified length of an X Windows MIT-MAGIC-COOKIE cookie, which allows remote attackers to execute arbitrary commands via a buffer overflow, or brute force authentication by using a short cookie length.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

• Access vector: Network. Exploitable remotely over the network.
• Access complexity: Low. No special conditions are required.
• Authentication: None. No authentication is needed.
• Confidentiality impact: Complete. Total information disclosure.
• Integrity impact: Complete. Total loss of integrity.
• Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-120: Buffer Copy without Checking Size of Input

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected products

• Andynorman Gnuserv: before 3.12

References

• http://archives.neohapsis.com/archives/bugtraq/2001-02/0030.html
• http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-019.php3
• http://www.redhat.com/support/errata/RHSA-2001-010.html
• http://www.redhat.com/support/errata/RHSA-2001-011.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6056