CVE-2002-0391
- State
- Published
- Severity
- 9.8 Critical
- Published
- Apr 2, 2003
- Updated
- Jan 16, 2025
- Reserved
- May 28, 2002
Description
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-190 Integer Overflow or Wraparound
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- sunrpc-xdr-array-bo(9170)vdb-entry
- CA-2002-25third-party-advisory
- HPSBTL0208-061vendor-advisory
- 20020909 GLSA: glibcmailing-list
- DSA-146vendor-advisory
- RHSA-2002:166vendor-advisory
- HPSBUX0209-215vendor-advisory
- DSA-143vendor-advisory
- 20020731 Remote Buffer Overflow Vulnerability in Sun RPCthird-party-advisory
- CLA-2002:515vendor-advisory
- CLA-2002:535vendor-advisory
- RHSA-2003:212vendor-advisory
- MS02-057vendor-advisory
- DSA-142vendor-advisory
- IY34194vendor-advisory
- RHSA-2002:167vendor-advisory
- 20020803 OpenAFS Security Advisory 2002-001: Remote root vulnerability in OpenAFS serversmailing-list
- FreeBSD-SA-02:34.rpcvendor-advisory
- RHSA-2002:173vendor-advisory
- 5356vdb-entry
- 20020802 kerberos rpc xdr_arraymailing-list
- 20020731 Remote Buffer Overflow Vulnerability in Sun RPCmailing-list
- 20020801 RPC analysismailing-list
- VU#192995third-party-advisory
- RHSA-2002:172vendor-advisory
- oval:org.mitre.oval:def:4728vdb-entrysignature
- oval:org.mitre.oval:def:42vdb-entrysignature
- ESA-20021003-021vendor-advisory
- oval:org.mitre.oval:def:9vdb-entrysignature
- MDKSA-2002:057vendor-advisory
- DSA-149vendor-advisory
- 20020802 MITKRB5-SA-2002-001: Remote root vulnerability in MIT krb5 adminmailing-list
- DSA-333vendor-advisory
- RHSA-2003:168vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.