SGI IRIX up to 6.5.10m Software Package eoe.sw.cpr memory corruption

Summaryinfo

A vulnerability marked as problematic has been reported in SGI IRIX. This issue affects some unknown processing of the file eoe.sw.cpr of the component Software Package. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2002-0173. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as critical has been found in SGI IRIX (Operating System). This affects an unknown code of the file eoe.sw.cpr of the component Software Package. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow in cpr for the eoe.sw.cpr SGI Checkpoint-Restart Software package on SGI IRIX 6.5.10 and earlier may allow local users to gain root privileges.

The bug was discovered 04/30/2002. The weakness was shared 05/01/2002 (Website). It is possible to read the advisory at patches.sgi.com. This vulnerability is uniquely identified as CVE-2002-0173. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 3348 days. During that time the estimated underground price was around $0-$5k.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at X-Force (8959), SecurityFocus (BID 4644†) and OSVDB (5359†). The entry VDB-18098 is related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• SGI

Name

• IRIX

Version

• 5.0
• 5.0.1
• 5.1
• 5.1.1
• 5.2
• 5.3
• 6.0
• 6.0.1
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.5.1
• 6.5.2
• 6.5.2f
• 6.5.2m
• 6.5.3
• 6.5.3f
• 6.5.3m
• 6.5.4
• 6.5.4f
• 6.5.4m
• 6.5.5
• 6.5.5f
• 6.5.5m
• 6.5.6
• 6.5.6f
• 6.5.6m
• 6.5.7
• 6.5.7f
• 6.5.7m
• 6.5.8
• 6.5.8f
• 6.5.8m
• 6.5.9
• 6.5.9f
• 6.5.9m
• 6.5.10
• 6.5.10f
• 6.5.10m

License

• commercial

Support

• end of life (old version)

Website

• Vendor: http://www.sgi.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion