critical
10
CWE
264
Advisory Published
CVE Published
Updated

CVE-2000-0844

First published: Tue Nov 14 2000(Updated: )

Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
SGI IRIX=6.5.6
SGI IRIX=6.5.3f
SGI IRIX=6.5.1
Conectiva Linux=4.2
Conectiva Linux=4.1
Conectiva Linux=5.1
CentOS Dos2unix=6.2
SGI IRIX=6.4
SGI IRIX=6.5.2m
SGI IRIX=6.5.3
SGI IRIX=6.5.3m
SGI IRIX=6.5.8
Conectiva Linux=4.0es
Caldera OpenLinux eBuilder=3.0
SGI IRIX=6.5.4
SGI IRIX=6.3
Conectiva Linux=5.0
SGI IRIX=6.5
SGI IRIX=6.5.7
SGI IRIX=6.2
Conectiva Linux=4.0
SUSE Linux=6.2
IBM AIX=4.3.2
IBM AIX=4.3
Sun SunOS=5.3
Debian=2.3
Trustix Secure Linux=1.1
IBM AIX=4.2.1
Red Hat Linux=5.1
Debian=2.2
Debian=2.1
IBM AIX=3.2.5
Mandrake Linux=7.0
Red Hat Linux=6.1
IBM AIX=3.2.4
Slackware Linux=7.1
IBM AIX=4.1.4
IBM AIX=4.2
IBM AIX=4.1.5
Red Hat Linux=6.2
Red Hat Linux=5.0
Mandrake Linux=7.1
Trustix Secure Linux=1.0
Sun SunOS=5.7
Sun SunOS=5.5
Sun SunOS=5.8
Turbolinux=6.0.1
SCO OpenLinux Server
Red Hat Linux=5.2
Turbolinux=6.0
Turbolinux=6.0.2
Slackware Linux=7.0
SUSE Linux=6.1
SCO OpenLinux Server=2.3
IBM AIX=4.0
IBM AIX=4.1.1
Turbolinux=6.0.4
Sun SunOS=5.4
SUSE Linux=7.0
SUSE Linux=6.3
Sun SunOS=5.5.1
IBM AIX=4.1.2
SUSE Linux=6.4
Debian=2.0
IBM AIX=4.3.1
Turbolinux=6.0.3
Red Hat Linux=6.0
IBM AIX=4.1
Sun SunOS=5.0
IBM AIX=4.1.3
IBM AIX=3.2
Oracle Solaris and Zettabyte File System (ZFS)=2.6
Sun SunOS=5.1
Sun SunOS=5.2
Debian Linux=2.0
Debian Linux=2.1
Debian Linux=2.2
Debian Linux=2.3
SunOS=5.0
SunOS=5.1
SunOS=5.2
SunOS=5.3
SunOS=5.4
SunOS=5.5
SunOS=5.5.1
SunOS=5.7
SunOS=5.8

Remedy

http://archives.neohapsis.com/archives/bugtraq/2000-08/0457.html

Remedy

http://www.securityfocus.com/bid/1634

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2000-0844?

    CVE-2000-0844 has been classified as a medium severity vulnerability due to its potential to allow local attackers to execute arbitrary commands.

  • How do I fix CVE-2000-0844?

    To fix CVE-2000-0844, users should upgrade to the latest version of the affected software that contains the necessary patches.

  • What systems are affected by CVE-2000-0844?

    CVE-2000-0844 affects various versions of SGI IRIX, Conectiva Linux, Caldera OpenLinux, IBM AIX, and several other Unix-like operating systems.

  • How does CVE-2000-0844 exploit user-injected format strings?

    CVE-2000-0844 exploits vulnerabilities in functions like gettext and catopen by not properly cleansing user-injected format strings.

  • Is CVE-2000-0844 still a threat today?

    While CVE-2000-0844 is older, it remains a threat if affected systems have not been patched or upgraded.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203