{"vuid":"VU#36866","idnumber":"36866","name":"Solaris ufsrestore buffer overflow in command pathname parameters for interactive session","keywords":["ufsrestore","interactive","buffer overflow","ufsdump"],"overview":"There is a buffer overflow in ufsrestore, a file restoration utility.","clean_desc":"When operating in interactive mode, the pathname parameter of the extract command is not properly bounds checked. When used in conjunction with long pathnames contained in the dump file, an internal buffer can be overflowed, allowing an attacker to overwrite memory and gain root privileges.","impact":"A local user can gain root privileges by exploiting this vulnerability.","resolution":"Apply a Patch\nApply a patch from your vendor.","workarounds":"Disable the setuid bit on ufsrestore You can prevent this vulnerability from being exploited by removing the setuid bit from ufsrestore.","sysaffected":"","thanks":"Thanks to Job de Haas (job@itsx.com) of ITSX BV Amsterdam, The Netherlands (\nhttp://www.itsx.com\n) for reporting this vulnerability to the CERT/CC.","author":"This document was written by Cory F Cohen.","public":["http://www.securityfocus.com/bid/1348","http://www.securityfocus.com/archive/1/64837","http://sunsolve.sun.com/private-cgi/retrieve.pl?doctype=coll&doc=secbull/210&type=0&nav=sec.sba"],"cveids":["CVE-2000-0471"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2000-06-21T23:05:01Z","publicdate":"2000-06-14T00:00:00Z","datefirstpublished":"2001-04-06T17:15:46Z","dateupdated":"2001-11-19T22:38:08Z","revision":12,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"7","cam_population":"11","cam_impact":"20","cam_easeofexploitation":"15","cam_attackeraccessrequired":"10","cam_scorecurrent":"16.70625","cam_scorecurrentwidelyknown":"16.70625","cam_scorecurrentwidelyknownexploited":"29.08125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":16.70625,"vulnote":null}