CVE-2000-0993: High severity NetBSD NetBSD vulnerability

Published Dec 19, 2000

Updated

Format string vulnerability in pwerror function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.

Affected Software

13 affected components

NetBSD NetBSD=1.4.2

OpenBSD OpenBSD=2.7

OpenBSD OpenBSD=2.4

FreeBSD FreeBSD=3.2

FreeBSD FreeBSD=3.3

FreeBSD FreeBSD=4.0

FreeBSD FreeBSD=3.4

FreeBSD FreeBSD=3.5

NetBSD NetBSD=1.4

OpenBSD OpenBSD=2.6

NetBSD NetBSD=1.4.1

OpenBSD OpenBSD=2.5

OpenBSD OpenBSD=2.3

Remediation

Patch Available

http://www.securityfocus.com/bid/1744

Event History

Dec 19, 2000

CVE Published

05:00 AM

Jan 22, 2001

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0993?

CVE-2000-0993 is considered to have a high severity level due to its potential to allow local users to gain root privileges.

How do I fix CVE-2000-0993?

To fix CVE-2000-0993, upgrade the affected BSD operating systems to their latest versions that contain the security patches.

Which operating systems are affected by CVE-2000-0993?

CVE-2000-0993 affects multiple versions of NetBSD, OpenBSD, and FreeBSD, particularly around their passwd functionalities.

What is the impact of CVE-2000-0993?

The impact of CVE-2000-0993 is that local users can leverage the format string vulnerability to execute arbitrary code with root privileges.

Is CVE-2000-0993 an exploit that requires remote access?

No, CVE-2000-0993 is a local vulnerability, meaning it requires an attacker to have local access to the affected system.