Vulnerability CVE-2005-0532 - CERT Civis.Net

Vulnerability Name:

CVE-2005-0532 (CCN-43162)

Assigned:

2005-02-24

Published:

2005-02-24

Updated:

2016-10-18

Summary:

The reiserfs_copy_from_user_to_file_region function in reiserfs/file.c for Linux kernel 2.6.10 and 2.6.11 before 2.6.11-rc4, when running on 64-bit architectures, may allow local users to trigger a buffer overflow as a result of casting discrepancies between size_t and int data types.

CVSS v3 Severity:

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)
1.6 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
3.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Full-Disclosure Mailing List, Tue Feb 15 2005 - 05:15:27 CST
linux kernel 2.6 fun. windoze is a joke

Source: MITRE
Type: CNA
CVE-2005-0532

Source: CCN
Type: BitKeeper Web site
Changeset details for 1.1982.29.38

Source: CONFIRM
Type: UNKNOWN
http://linux.bkbits.net:8080/linux-2.6/cset@42018227TkNpHlX6BefnItV_GqMmzQ

Source: BUGTRAQ
Type: UNKNOWN
20050315 [USN-95-1] Linux kernel vulnerabilities

Source: FULLDISC
Type: UNKNOWN
20050215 linux kernel 2.6 fun. windoze is a joke

Source: MISC
Type: Exploit, Patch, Vendor Advisory
http://www.guninski.com/where_do_you_want_billg_to_go_today_3.html

Source: CCN
Type: The Linux Kernel Archives Web site
The Linux Kernel Archives

Source: SUSE
Type: Patch, Vendor Advisory
SUSE-SA:2005:018

Source: CCN
Type: OSVDB ID: 14871
Linux Kernel reiserfs_copy_from_user_to_file_region Function Local Overflow

Source: CCN
Type: USN-95-1
Linux kernel vulnerabilities

Source: XF
Type: UNKNOWN
kernel-reiserfscopyfromusertofileregion-bo(43162)

Source: SUSE
Type: SUSE-SA:2005:018
kernel: remote denial of service

Vulnerable Configuration:

Configuration 1:

cpe:/o:linux:linux_kernel:2.6.10:-:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.11:-:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.11:rc1:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.11:rc2:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.11:rc3:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:linux:linux_kernel:2.6.11:rc1:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.11:rc3:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.11:rc2:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.0:-:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:2.6.10:-:*:*:*:*:*:*

AND

cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*

OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*

OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:2.0:*:*:*:*:*:*:*

OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20050532	V	CVE-2005-0532	2015-11-16