Vulnerability in Rahul Dhesi Zoo
CVE-2006-1269
Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation. NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.2 (Medium). Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.010 (62.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: +0.000
Affected products
- Rahul Dhesi Zoo — versions 2.10
References
- www.securityfocus.com/bid/17126 (vdb-entry)
- bugzilla.redhat.com/bugzilla/show_bug.cgi (Exploit, Patch)
- www.gentoo.org/security/en/glsa/glsa-200603-12.xml (Exploit, vendor-advisory, Patch)
- exchange.xforce.ibmcloud.com/vulnerabilities/25264 (vdb-entry)
- www.vupen.com/english/advisories/2006/0969 (vdb-entry)
- secunia.com/advisories/19254 (third-party-advisory)
- secunia.com/advisories/19250 (Exploit, Patch, Vendor Advisory, third-party-advisory)