Vulnerability CVE-2004-0579 - CERT Civis.Net

Vulnerability Name:

CVE-2004-0579 (CCN-16458)

Assigned:

2004-06-19

Published:

2004-06-19

Updated:

2017-07-11

Summary:

Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root.

CVSS v3 Severity:

9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2004-0579

Source: CCN
Type: super Web page
Project details for super

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-522

Source: DEBIAN
Type: DSA-522
super -- format string vulnerability

Source: CCN
Type: OSVDB ID: 7588
super Local Format String

Source: CCN
Type: BID-10575
Super Local Format String Vulnerability

Source: XF
Type: UNKNOWN
super-format-string(16458)

Source: XF
Type: UNKNOWN
super-format-string(16458)

Vulnerable Configuration:

Configuration 1:

cpe:/a:william_deich:super:3.12:*:*:*:*:*:*:*

OR cpe:/a:william_deich:super:3.16:*:*:*:*:*:*:*

OR cpe:/a:william_deich:super:3.17:*:*:*:*:*:*:*

OR cpe:/a:william_deich:super:3.18:*:*:*:*:*:*:*

OR cpe:/a:william_deich:super:3.19:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:alpha:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:arm:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:hppa:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:ia-32:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:ia-64:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:m68k:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:mips:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:mipsel:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:ppc:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:s-390:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:sparc:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.debian:def:522	V	format string vulnerability	2004-06-19