CVE-2001-1036

GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.osvdb.org/5477
http://www.securityfocus.com/archive/1/200991
http://www.securityfocus.com/bid/3127	Exploit Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6932
http://www.osvdb.org/5477
http://www.securityfocus.com/archive/1/200991
http://www.securityfocus.com/bid/3127	Exploit Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6932

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gnu:findutils:4.0:::::::*
	cpe:2.3:a:gnu:findutils:4.1:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:slackware:slackware_linux:7.1:::::::*
	cpe:2.3:o:slackware:slackware_linux:8.0:::::::*

History

No history.

Information

Published : 2001-08-31 04:00

Updated : 2025-04-03 01:03

NVD link : CVE-2001-1036

Mitre link : CVE-2001-1036

CVE.ORG link : CVE-2001-1036

JSON object : View

Products Affected

slackware

slackware_linux

gnu

findutils

CWE

NVD-CWE-Other

{"id": "CVE-2001-1036", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2001-08-31T04:00:00.000", "references": [{"url": "http://www.osvdb.org/5477", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/200991", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/3127", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6932", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/5477", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/200991", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/3127", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6932", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:findutils:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CA98BAA-CDE7-4255-B4A9-926CA2BF9783"}, {"criteria": "cpe:2.3:a:gnu:findutils:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82F0B7F9-8A8E-4717-9C78-A26141AC66BC"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:slackware:slackware_linux:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0297F56-5F41-48FD-AB47-36E3BD2AB7E7"}, {"criteria": "cpe:2.3:o:slackware:slackware_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78D76664-F4AC-470A-9686-3F708922A340"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}