Vulnerability Name:

CVE-2003-0188 (CCN-12017)

Assigned:2003-05-16
Published:2003-05-16
Updated:2017-10-11
Summary:lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv files into other directories.
CVSS v3 Severity:9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2003-0188

Source: CCN
Type: RHSA-2003-167
lv security update

Source: CCN
Type: RHSA-2003-169
Updated lv packages fix vulnerability

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-304

Source: DEBIAN
Type: DSA-304
lv -- privilege escalation

Source: CCN
Type: Gentoo Linux Security Announcement 200305-07
lv arbitrary command execution

Source: REDHAT
Type: UNKNOWN
RHSA-2003:167

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2003:169

Source: CCN
Type: BID-7613
lv Configuration File Privilege Escalation Vulnerability

Source: CCN
Type: TLSA-2003-35
Privilege escalation

Source: TURBO
Type: UNKNOWN
TLSA-2003-35

Source: XF
Type: UNKNOWN
lv-program-execution(12017)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:430

Vulnerable Configuration:Configuration 1:
  • cpe:/a:lv:lv:4.49.1:*:*:*:*:*:*:*
  • OR cpe:/a:lv:lv:4.49.2:*:*:*:*:*:*:*
  • OR cpe:/a:lv:lv:4.49.3:*:*:*:*:*:*:*
  • OR cpe:/a:lv:lv:4.49.4:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:lv:4.49.4-1:*:i386:*:*:*:*:*
  • OR cpe:/a:redhat:lv:4.49.4-3:*:i386:*:*:*:*:*
  • OR cpe:/a:redhat:lv:4.49.4-7:*:i386:*:*:*:*:*
  • OR cpe:/a:redhat:lv:4.49.4-9:*:i386:*:*:*:*:*

  • Configuration 2:
  • cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:9.0:*:i386:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:redhat:lv:-:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:430
    V
    Multilingual File Viewer .lv File Sneak Attack Vulnerability
    2007-04-25
    oval:org.debian:def:304
    V
    privilege escalation
    2003-05-15
    BACK
    lv lv 4.49.1
    lv lv 4.49.2
    lv lv 4.49.3
    lv lv 4.49.4
    redhat lv 4.49.4-1
    redhat lv 4.49.4-3
    redhat lv 4.49.4-7
    redhat lv 4.49.4-9
    redhat linux 7.1
    redhat linux 7.2
    redhat linux 7.3
    redhat linux 8.0
    redhat linux 9.0
    redhat lv -
    debian debian linux 2.2
    redhat linux 7
    redhat linux 7.1
    redhat linux 7.2
    redhat linux 7.3
    debian debian linux 3.0
    gentoo linux *
    redhat linux 8.0
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat linux 9.0
    redhat enterprise linux 2.1
    redhat linux advanced workstation 2.1