« Volver al listado

CVE-2003-0671

Estado: ModificadaAlta (7.2)—

Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jeremy Elson — Tcpflow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2003-0671",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2003-08-27T04:00:00.000",
  "references": [
    {
      "url": "http://www.atstake.com/research/advisories/2003/a080703-1.txt",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.atstake.com/research/advisories/2003/a080703-2.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.atstake.com/research/advisories/2003/a080703-1.txt",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.atstake.com/research/advisories/2003/a080703-2.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cadena de formato en tcpflow, cuando se usa en un contexto setuid, permite a usuarios locales ejecutar código arbitrario mediante el argumento de nombre de dispositivo, como se ha demostrado con Sustworks IPNetSentryX e IPNetMonitorX usando el progarma ayudante RunTCPFlow."
    }
  ],
  "lastModified": "2026-06-16T22:02:37.520",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jeremy_elson:tcpflow:0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "704B1CD5-93D1-4909-A5AF-65BE72283F8A"
            },
            {
              "criteria": "cpe:2.3:a:jeremy_elson:tcpflow:0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C080FBB4-3AF2-4B84-A5FC-5732009B4A37"
            },
            {
              "criteria": "cpe:2.3:a:jeremy_elson:tcpflow:0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42DE7D19-8D47-4D3A-934D-E7E153C3F68E"
            },
            {
              "criteria": "cpe:2.3:a:jeremy_elson:tcpflow:0.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "159236AE-4736-49D2-9643-0842C4B0BCA8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}