CVE-2000-0170: Buffer Overflow
Buffer overflow in the man program in Linux allows local users to gain privileges via the MANPAGER environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the MANPAGER environment variable cannot be used to control privileged executions of man. For example, sanitize or unset MANPAGER in any wrapper or service that runs man with elevated privileges, and enforce a fixed safe pager for privileged runs.
man MANPAGER environment variable = unset or set to a fixed, safe pager - Compensating control
Restrict who can execute the man program until a vendor patch is available—adjust file permissions or ACLs to limit execution to trusted accounts or otherwise prevent unprivileged local users from invoking privileged instances of man.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0170?
CVE-2000-0170 has a medium severity rating due to its potential to allow local users to gain elevated privileges.
How do I fix CVE-2000-0170?
To fix CVE-2000-0170, you should update the man program to a version that does not have this buffer overflow vulnerability.
Which systems are affected by CVE-2000-0170?
CVE-2000-0170 affects several versions of Red Hat Linux from 4.0 to 6.2 and Turbolinux versions 3.5b2 to 4.4.
Can CVE-2000-0170 be exploited remotely?
CVE-2000-0170 cannot be exploited remotely as it requires local access to the system by a user.
What is the exploitation method for CVE-2000-0170?
CVE-2000-0170 is exploited through the MANPAGER environment variable, which triggers a buffer overflow in the man program.