Sign-up

ID

VAR-200312-0205


CVE

CVE-2003-1104


TITLE

IBM Tivoli Firewall Toolbox contains vulnerability

Trust: 0.8

sources: CERT/CC: VU#210937

DESCRIPTION

Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) 1.2 allows remote attackers to execute arbitrary code via unknown vectors. A vulnerability in the Tivoli Firewall Toolbox version 1.2 has been discovered that can lead to remote unauthorized compromise of the environment with in the firewall system. The problem exists because the Firewall Security Toolbox relay daemon fails to perform adequate bounds checking on received data. The relay daemon process included in TFST listens to the TCP network socket. When storing data from the Tivoli node to the memory buffer, no boundary check operation is performed. If a forged Tivoli node provides a large amount of data, it can Buffer overflow occurs in the Relay daemon program, and important program control data in the control stack can cause arbitrary instructions to be executed on the system with the Relay process authority. Under the Unix platform, the \'\'nobody\'\' authority is generally used

Trust: 1.98

sources: NVD: CVE-2003-1104 // CERT/CC: VU#210937 // BID: 7154 // VULHUB: VHN-7929

AFFECTED PRODUCTS

vendor:ibmmodel:tivoli firewall toolboxscope:eqversion:1.2

Trust: 1.6

vendor:tivolimodel: - scope: - version: -

Trust: 0.8

vendor:ibmmodel:tivoli firewall security toolboxscope:eqversion:1.2

Trust: 0.3

vendor:ibmmodel:tivoli firewall security toolboxscope:neversion:1.3

Trust: 0.3

sources: CERT/CC: VU#210937 // BID: 7154 // CNNVD: CNNVD-200312-268 // NVD: CVE-2003-1104

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2003-1104
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#210937
value: 10.31

Trust: 0.8

CNNVD: CNNVD-200312-268
value: CRITICAL

Trust: 0.6

VULHUB: VHN-7929
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2003-1104
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-7929
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#210937 // VULHUB: VHN-7929 // CNNVD: CNNVD-200312-268 // NVD: CVE-2003-1104

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2003-1104

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200312-268

TYPE

Boundary Condition Error

Trust: 0.9

sources: BID: 7154 // CNNVD: CNNVD-200312-268

EXTERNAL IDS

db:CERT/CCid:VU#210937

Trust: 2.5

db:BIDid:7154

Trust: 2.0

db:SECUNIAid:8349

Trust: 1.7

db:NVDid:CVE-2003-1104

Trust: 1.7

db:CNNVDid:CNNVD-200312-268

Trust: 0.7

db:BUGTRAQid:20030320 IBM TIVOLI FIREWALL SECURITY TOOLBOX BUFFER OVERFLOW VULNERABILITY

Trust: 0.6

db:NSFOCUSid:4583

Trust: 0.6

db:XFid:11584

Trust: 0.6

db:VULHUBid:VHN-7929

Trust: 0.1

sources: CERT/CC: VU#210937 // VULHUB: VHN-7929 // BID: 7154 // CNNVD: CNNVD-200312-268 // NVD: CVE-2003-1104

REFERENCES

url:http://www.securityfocus.com/bid/7154

Trust: 1.7

url:http://archives.neohapsis.com/archives/bugtraq/2003-03/0307.html

Trust: 1.7

url:http://www.kb.cert.org/vuls/id/210937

Trust: 1.7

url:http://secunia.com/advisories/8349

Trust: 1.7

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/11584

Trust: 1.1

url:about vulnerability notes

Trust: 0.8

url:contact us about this vulnerability

Trust: 0.8

url:provide a vendor statement

Trust: 0.8

url:http://xforce.iss.net/xforce/xfdb/11584

Trust: 0.6

url:http://www.nsfocus.net/vulndb/4583

Trust: 0.6

url:http://www-3.ibm.com/software/tivoli/

Trust: 0.3

url:/archive/1/315733

Trust: 0.3

sources: CERT/CC: VU#210937 // VULHUB: VHN-7929 // BID: 7154 // CNNVD: CNNVD-200312-268 // NVD: CVE-2003-1104

CREDITS

Niels Heinen※ niels.heinen@ubizen.com

Trust: 0.6

sources: CNNVD: CNNVD-200312-268

SOURCES

db:CERT/CCid:VU#210937
db:VULHUBid:VHN-7929
db:BIDid:7154
db:CNNVDid:CNNVD-200312-268
db:NVDid:CVE-2003-1104

LAST UPDATE DATE

2024-08-14T15:20:18.375000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#210937date:2003-03-19T00:00:00
db:VULHUBid:VHN-7929date:2017-07-11T00:00:00
db:BIDid:7154date:2003-03-20T00:00:00
db:CNNVDid:CNNVD-200312-268date:2005-10-20T00:00:00
db:NVDid:CVE-2003-1104date:2017-07-11T01:29:44.727

SOURCES RELEASE DATE

db:CERT/CCid:VU#210937date:2003-03-19T00:00:00
db:VULHUBid:VHN-7929date:2003-12-31T00:00:00
db:BIDid:7154date:2003-03-20T00:00:00
db:CNNVDid:CNNVD-200312-268date:2003-03-20T00:00:00
db:NVDid:CVE-2003-1104date:2003-12-31T05:00:00