National Cyber-Alert System

Vulnerability Summary for CVE-2002-1317

Overview

Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a certain XFS query.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

CERT/CC Advisory: CA-2002-34

Name: CA-2002-34

Type: Advisory

Hyperlink:http://www.cert.org/advisories/CA-2002-34.html

US-CERT Vulnerability Note: VU#312313

Name: VU#312313

Hyperlink:http://www.kb.cert.org/vuls/id/312313

External Source: BID

Name: 6241

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/bid/6241

External Source: XF

Name: solaris-fsauto-execute-code(10375)

Type: Advisory; Patch Information

Hyperlink:http://www.iss.net/security_center/static/10375.php

External Source: ISS

Name: 20021125 Solaris fs.auto Remote Compromise Vulnerability

Type: Advisory; Patch Information

Hyperlink:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21541

External Source: CONFIRM

Name: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/48879

Hyperlink:http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/48879

External Source: HP

Name: HPSBUX0212-228

Hyperlink:http://www.securityfocus.com/advisories/4988

External Source: CIAC

Name: N-024

Hyperlink:http://www.ciac.org/ciac/bulletins/n-024.shtml

External Source: BUGTRAQ

Name: 20021125 ISS Security Brief: Solaris fs.auto Remote Compromise Vulnerability

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=103825150527843&w=2

External Source: SGI

Name: 20021202-01-I

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20021202-01-I

US Government Resource: oval:org.mitre.oval:def:2816

Name: oval:org.mitre.oval:def:2816

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2816

US Government Resource: oval:org.mitre.oval:def:152

Name: oval:org.mitre.oval:def:152

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:152

US Government Resource: oval:org.mitre.oval:def:149

Name: oval:org.mitre.oval:def:149

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:149