CVE-2000-0032 : Detail

CVE-2000-0032

0.5%V3
Network
2000-07-12
02h00 +00:00
2004-09-02
07h00 +00:00
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Solaris dmi_cmd allows local users to crash the dmispd daemon by adding a malformed file to the /var/dmi/db database.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Exploit information

Exploit Database EDB-ID : 19681

Publication date : 1999-12-21 23h00 +00:00
Author : Brock Tellier
EDB Verified : Yes

source: https://www.securityfocus.com/bid/878/info DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely). Buffer Overflow Crash: echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif dmi_cmd -CI ../../../usr/home/btellier/my.mif (dmispd segfaults)

Products Mentioned

Configuraton 0

Sun>>Solaris >> Version 7.0

    Sun>>Sunos >> Version 5.7

    References

    http://www.securityfocus.com/bid/878
    Tags : vdb-entry, x_refsource_BID
    http://www.osvdb.org/7582
    Tags : vdb-entry, x_refsource_OSVDB