CVE-2005-1394

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2005-1394
Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environment variable to (1) wservice or (2) lockmgr.

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://marc.info/?l=full-disclosure&m=111489411524630&w=2 Mailing List Third Party Advisory
http://secunia.com/advisories/15196 Broken Link
http://securitytracker.com/id?1013852 Broken Link Patch Third Party Advisory VDB Entry Vendor Advisory
http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015 Vendor Advisory
http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txt Patch Third Party Advisory
http://marc.info/?l=full-disclosure&m=111489411524630&w=2 Mailing List Third Party Advisory
http://secunia.com/advisories/15196 Broken Link
http://securitytracker.com/id?1013852 Broken Link Patch Third Party Advisory VDB Entry Vendor Advisory
http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015 Vendor Advisory
http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txt Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:esri:arcinfo_workstation:9.0:*:*:*:*:*:*:*
History

20 Nov 2024, 23:57

Type Values Removed Values Added
References () http://marc.info/?l=full-disclosure&m=111489411524630&w=2 - Mailing List, Third Party Advisory () http://marc.info/?l=full-disclosure&m=111489411524630&w=2 - Mailing List, Third Party Advisory
References () http://secunia.com/advisories/15196 - Broken Link () http://secunia.com/advisories/15196 - Broken Link
References () http://securitytracker.com/id?1013852 - Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory () http://securitytracker.com/id?1013852 - Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
References () http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015 - Vendor Advisory () http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015 - Vendor Advisory
References () http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txt - Patch, Third Party Advisory () http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txt - Patch, Third Party Advisory

11 Jul 2024, 18:03

Type Values Removed Values Added
CPE cpe:2.3:a:esri:arcgis:9.0:*:*:*:*:*:*:*
CWE NVD-CWE-Other CWE-134
References () http://marc.info/?l=full-disclosure&m=111489411524630&w=2 - () http://marc.info/?l=full-disclosure&m=111489411524630&w=2 - Mailing List, Third Party Advisory
References () http://secunia.com/advisories/15196 - Vendor Advisory () http://secunia.com/advisories/15196 - Broken Link
References () http://securitytracker.com/id?1013852 - Patch, Vendor Advisory () http://securitytracker.com/id?1013852 - Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
References () http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015 - () http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015 - Vendor Advisory
References () http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txt - Patch () http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txt - Patch, Third Party Advisory
Information

Published : 2005-05-03 04:00

Updated : 2024-11-20 23:57

NVD link : CVE-2005-1394

Mitre link : CVE-2005-1394

CVE.ORG link : CVE-2005-1394

JSON object : View

Products Affected

esri

  • arcinfo_workstation
CWE
CWE-134

Use of Externally-Controlled Format String