| Vulnerability Name: | CVE-2002-2180 (CCN-10278) | ||||||||
| Assigned: | 2002-10-02 | ||||||||
| Published: | 2002-10-02 | ||||||||
| Updated: | 2008-09-05 | ||||||||
| Summary: | The setitimer(2) system call in OpenBSD 2.0 through 3.1 does not properly check certain arguments, which allows local users to write to kernel memory and possibly gain root privileges, possibly via an integer signedness error. | ||||||||
| CVSS v3 Severity: | 8.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||
| References: | Source: CONFIRM Type: Patch ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.0/common/032_kerntime.patch Source: MITRE Type: CNA CVE-2002-2180 Source: XF Type: Patch, Vendor Advisory openbsd-setitimer-memory-overwrite(10278) Source: CCN Type: OpenBSD 3.1 errata 015: SECURITY FIX: October 2, 2002 Source: OPENBSD Type: Exploit, Patch, Vendor Advisory 20021002 Incorrect argument checking in the setitimer(2) system call may allow an attacker to write to kernel memory. Source: CCN Type: OSVDB ID: 60108 OpenBSD setitimer(2) System Call Local Privilege Escalation Source: BID Type: Patch, Vendor Advisory 5861 Source: CCN Type: BID-5861 OpenBSD setitimer(2) Kernel Memory Overwrite Vulnerability Source: XF Type: UNKNOWN openbsd-setitimer-memory-overwrite(10278) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||