Improper privilege management in Linux kernel - CVE-2003-0018
Published: February 19, 2003 / Updated: September 11, 2008
Vulnerability identifier: #VU99977
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2003-0018
CWE-ID: CWE-269
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to read memory contents or crash the application.
Linux kernel 2.4.10 through 2.4.21-pre4 does not properly handle the O_DIRECT feature, which allows local attackers with write privileges to read portions of previously deleted files, or cause file system corruption.
How to mitigate CVE-2003-0018
Install update from vendor's repository.
Sources
- http://linux.bkbits.net:8080/linux-2.4/cset@3e2f193drGJDBg9SG6JwaDQwCBnAMQ
- http://www.debian.org/security/2003/dsa-358
- http://www.debian.org/security/2004/dsa-423
- http://www.iss.net/security_center/static/11249.php
- http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:014
- http://www.redhat.com/support/errata/RHSA-2003-025.html
- http://www.securityfocus.com/bid/6763