CVE-2003-0671

Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow.

Published: Aug 27, 2003
Updated: Apr 13, 2023
CVE: CVE-2003-0671
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
jeremy_elson / tcpflow	0.10	0.10.x
jeremy_elson / tcpflow	0.20	0.20.x
jeremy_elson / tcpflow	0.11	0.11.x
jeremy_elson / tcpflow	0.12	0.12.x

http://www.atstake.com/research/advisories/2003/a080703-1.txt
http://www.atstake.com/research/advisories/2003/a080703-2.txt

Vulnerability Database

CVE-2003-0671