CVE-2003-0449

State: Published
Severity: Not scored
Published: Jun 20, 2003
Updated: Aug 8, 2024
Reserved: Jun 19, 2003

Description

Progress Database 9.1 to 9.1D06 trusts user input to find and load libraries using dlopen, which allows local users to gain privileges via (1) a PATH environment variable that points to malicious libraries, as demonstrated using libjutil.so in_proapsv, or (2) the -installdir command line parameter, as demonstrated using librocket_r.so in _dbagent.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

20030614 SRT2003-06-13-0945 - Progress PATH based dlopen() issuemailing-list
http://www.secnetops.com/research/advisories/SRT2003-06-13-1009.txt
http://www.secnetops.com/research/advisories/SRT2003-06-13-0945.txt
20030614 SRT2003-06-13-1009 - Progress _dbagent -installdir dlopen() issuemailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.