CVE-2000-0844 - 漏洞详情

CVE-2000-0844 (CNNVD-200011-069)

CRITICAL 有利用代码

中文标题:

HP-UX NLSPATH环境变量权限提升漏洞

英文标题:

Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected fo...

CVSS分数: 10.0

发布时间: 2001-01-22 05:00:00

漏洞类型: 授权问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v14

漏洞描述

中文描述:

HP－UX 中的很多程序都使用libc库中的catopen()/catgets()等函数来显示本地化的信息。catopen()函数在检测到NLSPATH环境变量之后，会打开其指定的文件并从中读取消息。然而，catopen()函数并没有对suid root程序使用NLSPATH变量进行限制，这允许本地攻击者通过设置NLSPATH变量指定自己构造的locale文件，当suid root程序将使用catopen()打开该消息文件并将其中的数据传递给*printf()函数时，就可能造成格式串漏洞。任何使用catopen()/catgets()函数的suid root程序都可能受此漏洞影响，本地攻击者可以利用此漏洞获取root权限。根据我们的测试，至少如下程序是受影响的: -r-sr-xr-x 1 root bin 45056 Nov 14 2000 /usr/bin/at -r-sr-xr-x 1 root bin 24576 Nov 14 2000 /usr/bin/crontab -r-sr-xr-x 1 root bin 45056 Nov 14 2000 /usr/bin/ct -r-sr-xr-x 1 root bin 36864 Apr 19 2001 /usr/bin/cu -r-sr-xr-x 1 root bin 20480 Nov 14 2000 /usr/lbin/exrecover -r-sr-xr-x 1 root bin 40960 Aug 16 2001 /usr/bin/lp -r-sr-sr-x 2 root mail 45056 Nov 14 2000 /usr/bin/mail -r-sr-xr-x 5 root bin 45056 Nov 14 2000 /usr/bin/passwd -r-sr-xr-x 1 root bin 24576 Nov 14 2000 /usr/bin/su -r-sr-xr-x 11 root bin 1921024 Nov 6 2001 /usr/sbin/swinstall -r-sr-xr-x 2 root bin 1028096 Nov 6 2001 /usr/sbin/swpackage

英文描述:

Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.

CWE类型:

CWE-264

受影响产品

厂商	产品	版本	版本范围	平台	CPE
caldera	openlinux_ebuilder	3.0	-	-	`cpe:2.3:a:caldera:openlinux_ebuilder:3.0:::::::*`
immunix	immunix	6.2	-	-	`cpe:2.3:a:immunix:immunix:6.2:::::::*`
conectiva	linux	4.0	-	-	`cpe:2.3:o:conectiva:linux:4.0:::::::*`
conectiva	linux	4.0es	-	-	`cpe:2.3:o:conectiva:linux:4.0es:::::::*`
conectiva	linux	4.1	-	-	`cpe:2.3:o:conectiva:linux:4.1:::::::*`
conectiva	linux	4.2	-	-	`cpe:2.3:o:conectiva:linux:4.2:::::::*`
conectiva	linux	5.0	-	-	`cpe:2.3:o:conectiva:linux:5.0:::::::*`
conectiva	linux	5.1	-	-	`cpe:2.3:o:conectiva:linux:5.1:::::::*`
sgi	irix	6.2	-	-	`cpe:2.3:o:sgi:irix:6.2:::::::*`
sgi	irix	6.3	-	-	`cpe:2.3:o:sgi:irix:6.3:::::::*`
sgi	irix	6.4	-	-	`cpe:2.3:o:sgi:irix:6.4:::::::*`
sgi	irix	6.5	-	-	`cpe:2.3:o:sgi:irix:6.5:::::::*`
sgi	irix	6.5.1	-	-	`cpe:2.3:o:sgi:irix:6.5.1:::::::*`
sgi	irix	6.5.2m	-	-	`cpe:2.3:o:sgi:irix:6.5.2m:::::::*`
sgi	irix	6.5.3	-	-	`cpe:2.3:o:sgi:irix:6.5.3:::::::*`
sgi	irix	6.5.3f	-	-	`cpe:2.3:o:sgi:irix:6.5.3f:::::::*`
sgi	irix	6.5.3m	-	-	`cpe:2.3:o:sgi:irix:6.5.3m:::::::*`
sgi	irix	6.5.4	-	-	`cpe:2.3:o:sgi:irix:6.5.4:::::::*`
sgi	irix	6.5.6	-	-	`cpe:2.3:o:sgi:irix:6.5.6:::::::*`
sgi	irix	6.5.7	-	-	`cpe:2.3:o:sgi:irix:6.5.7:::::::*`
sgi	irix	6.5.8	-	-	`cpe:2.3:o:sgi:irix:6.5.8:::::::*`
caldera	openlinux	*	-	-	`cpe:2.3:o:caldera:openlinux::::::::`
caldera	openlinux_eserver	2.3	-	-	`cpe:2.3:o:caldera:openlinux_eserver:2.3:::::::*`
debian	debian_linux	2.0	-	-	`cpe:2.3:o:debian:debian_linux:2.0:::::::*`
debian	debian_linux	2.1	-	-	`cpe:2.3:o:debian:debian_linux:2.1:::::::*`
debian	debian_linux	2.2	-	-	`cpe:2.3:o:debian:debian_linux:2.2:::::::*`
debian	debian_linux	2.3	-	-	`cpe:2.3:o:debian:debian_linux:2.3:::::::*`
ibm	aix	3.2	-	-	`cpe:2.3:o:ibm:aix:3.2:::::::*`
ibm	aix	3.2.4	-	-	`cpe:2.3:o:ibm:aix:3.2.4:::::::*`
ibm	aix	3.2.5	-	-	`cpe:2.3:o:ibm:aix:3.2.5:::::::*`
ibm	aix	4.0	-	-	`cpe:2.3:o:ibm:aix:4.0:::::::*`
ibm	aix	4.1	-	-	`cpe:2.3:o:ibm:aix:4.1:::::::*`
ibm	aix	4.1.1	-	-	`cpe:2.3:o:ibm:aix:4.1.1:::::::*`
ibm	aix	4.1.2	-	-	`cpe:2.3:o:ibm:aix:4.1.2:::::::*`
ibm	aix	4.1.3	-	-	`cpe:2.3:o:ibm:aix:4.1.3:::::::*`
ibm	aix	4.1.4	-	-	`cpe:2.3:o:ibm:aix:4.1.4:::::::*`
ibm	aix	4.1.5	-	-	`cpe:2.3:o:ibm:aix:4.1.5:::::::*`
ibm	aix	4.2	-	-	`cpe:2.3:o:ibm:aix:4.2:::::::*`
ibm	aix	4.2.1	-	-	`cpe:2.3:o:ibm:aix:4.2.1:::::::*`
ibm	aix	4.3	-	-	`cpe:2.3:o:ibm:aix:4.3:::::::*`
ibm	aix	4.3.1	-	-	`cpe:2.3:o:ibm:aix:4.3.1:::::::*`
ibm	aix	4.3.2	-	-	`cpe:2.3:o:ibm:aix:4.3.2:::::::*`
mandrakesoft	mandrake_linux	7.0	-	-	`cpe:2.3:o:mandrakesoft:mandrake_linux:7.0:::::::*`
mandrakesoft	mandrake_linux	7.1	-	-	`cpe:2.3:o:mandrakesoft:mandrake_linux:7.1:::::::*`
redhat	linux	5.0	-	-	`cpe:2.3:o:redhat:linux:5.0:::::::*`
redhat	linux	5.1	-	-	`cpe:2.3:o:redhat:linux:5.1:::::::*`
redhat	linux	5.2	-	-	`cpe:2.3:o:redhat:linux:5.2:::::::*`
redhat	linux	6.0	-	-	`cpe:2.3:o:redhat:linux:6.0:::::::*`
redhat	linux	6.1	-	-	`cpe:2.3:o:redhat:linux:6.1:::::::*`
redhat	linux	6.2	-	-	`cpe:2.3:o:redhat:linux:6.2:::::::*`
slackware	slackware_linux	7.0	-	-	`cpe:2.3:o:slackware:slackware_linux:7.0:::::::*`
slackware	slackware_linux	7.1	-	-	`cpe:2.3:o:slackware:slackware_linux:7.1:::::::*`
sun	solaris	2.6	-	-	`cpe:2.3:o:sun:solaris:2.6:::::::*`
sun	sunos	5.0	-	-	`cpe:2.3:o:sun:sunos:5.0:::::::*`
sun	sunos	5.1	-	-	`cpe:2.3:o:sun:sunos:5.1:::::::*`
sun	sunos	5.2	-	-	`cpe:2.3:o:sun:sunos:5.2:::::::*`
sun	sunos	5.3	-	-	`cpe:2.3:o:sun:sunos:5.3:::::::*`
sun	sunos	5.4	-	-	`cpe:2.3:o:sun:sunos:5.4:::::::*`
sun	sunos	5.5	-	-	`cpe:2.3:o:sun:sunos:5.5:::::::*`
sun	sunos	5.5.1	-	-	`cpe:2.3:o:sun:sunos:5.5.1:::::::*`
sun	sunos	5.7	-	-	`cpe:2.3:o:sun:sunos:5.7:::::::*`
sun	sunos	5.8	-	-	`cpe:2.3:o:sun:sunos:5.8:::::::*`
suse	suse_linux	6.1	-	-	`cpe:2.3:o:suse:suse_linux:6.1:::::::*`
suse	suse_linux	6.2	-	-	`cpe:2.3:o:suse:suse_linux:6.2:::::::*`
suse	suse_linux	6.3	-	-	`cpe:2.3:o:suse:suse_linux:6.3:::::::*`
suse	suse_linux	6.4	-	-	`cpe:2.3:o:suse:suse_linux:6.4:::::::*`
suse	suse_linux	7.0	-	-	`cpe:2.3:o:suse:suse_linux:7.0:::::::*`
trustix	secure_linux	1.0	-	-	`cpe:2.3:o:trustix:secure_linux:1.0:::::::*`
trustix	secure_linux	1.1	-	-	`cpe:2.3:o:trustix:secure_linux:1.1:::::::*`
turbolinux	turbolinux	6.0	-	-	`cpe:2.3:o:turbolinux:turbolinux:6.0:::::::*`
turbolinux	turbolinux	6.0.1	-	-	`cpe:2.3:o:turbolinux:turbolinux:6.0.1:::::::*`
turbolinux	turbolinux	6.0.2	-	-	`cpe:2.3:o:turbolinux:turbolinux:6.0.2:::::::*`
turbolinux	turbolinux	6.0.3	-	-	`cpe:2.3:o:turbolinux:turbolinux:6.0.3:::::::*`
turbolinux	turbolinux	6.0.4	-	-	`cpe:2.3:o:turbolinux:turbolinux:6.0.4:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2000:057 vendor-advisory
cve.org

访问

20000906 glibc locale security problem vendor-advisory
cve.org

访问

20000902 Conectiva Linux Security Announcement - glibc mailing-list
cve.org

访问

SSRT0689U vendor-advisory
cve.org

访问

TLSA2000020-1 vendor-advisory
cve.org

访问

20000902 glibc: local root exploit vendor-advisory
cve.org

访问

20000904 UNIX locale format string vulnerability mailing-list
cve.org

访问

IY13753 vendor-advisory
cve.org

访问

1634 vdb-entry
cve.org

访问

CSSA-2000-030.0 vendor-advisory
cve.org

访问

unix-locale-format-string(5176) vdb-entry
cve.org

访问

20000901-01-P vendor-advisory
cve.org

访问

ExploitDB EDB-197 EXPLOIT
exploitdb

访问

Download Exploit EDB-197 EXPLOIT
exploitdb

访问

CVE Reference: CVE-2000-0844 ADVISORY
cve.org

访问

ExploitDB EDB-20185 EXPLOIT
exploitdb

访问

Download Exploit EDB-20185 EXPLOIT
exploitdb

访问

ExploitDB EDB-20186 EXPLOIT
exploitdb

访问

Download Exploit EDB-20186 EXPLOIT
exploitdb

访问

ExploitDB EDB-20187 EXPLOIT
exploitdb

访问

Download Exploit EDB-20187 EXPLOIT
exploitdb

访问

ExploitDB EDB-20188 EXPLOIT
exploitdb

访问

Download Exploit EDB-20188 EXPLOIT
exploitdb

访问

ExploitDB EDB-20189 EXPLOIT
exploitdb

访问

Download Exploit EDB-20189 EXPLOIT
exploitdb

访问

ExploitDB EDB-20190 EXPLOIT
exploitdb

访问

Download Exploit EDB-20190 EXPLOIT
exploitdb

访问

ExploitDB EDB-209 EXPLOIT
exploitdb

访问

Download Exploit EDB-209 EXPLOIT
exploitdb

访问

ExploitDB EDB-210 EXPLOIT
exploitdb

访问

Download Exploit EDB-210 EXPLOIT
exploitdb

访问

ExploitDB EDB-215 EXPLOIT
exploitdb

访问

Download Exploit EDB-215 EXPLOIT
exploitdb

访问

ExploitDB EDB-249 EXPLOIT
exploitdb

访问

Download Exploit EDB-249 EXPLOIT
exploitdb

访问

CVSS评分详情

10.0

CRITICAL

CVSS向量: AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS版本: 2.0

机密性

COMPLETE

完整性

COMPLETE

可用性

COMPLETE

时间信息

发布时间:

2001-01-22 05:00:00

修改时间:

2024-08-08 05:37:30

创建时间:

2025-11-11 15:32:12

更新时间:

2025-11-11 16:21:04

利用信息

此漏洞有可利用代码！

利用代码数量: 11

利用来源:

未知未知未知未知未知未知未知未知未知未知未知

数据源详情

数据源	记录ID	版本	提取时间
CVE	`cve_CVE-2000-0844`	2025-11-11 15:17:20	2025-11-11 07:32:12
NVD	`nvd_CVE-2000-0844`	2025-11-11 14:50:25	2025-11-11 07:40:58
CNNVD	`cnnvd_CNNVD-200011-069`	2025-11-11 15:08:39	2025-11-11 07:48:44
EXPLOITDB	`exploitdb_EDB-197`	2025-11-11 15:05:48	2025-11-11 08:15:10
EXPLOITDB	`exploitdb_EDB-20185`	2025-11-11 15:05:25	2025-11-11 08:15:26
EXPLOITDB	`exploitdb_EDB-20186`	2025-11-11 15:05:48	2025-11-11 08:15:26
EXPLOITDB	`exploitdb_EDB-20187`	2025-11-11 15:05:23	2025-11-11 08:15:26
EXPLOITDB	`exploitdb_EDB-20188`	2025-11-11 15:05:48	2025-11-11 08:15:26
EXPLOITDB	`exploitdb_EDB-20189`	2025-11-11 15:05:48	2025-11-11 08:15:26
EXPLOITDB	`exploitdb_EDB-20190`	2025-11-11 15:05:48	2025-11-11 08:15:26
EXPLOITDB	`exploitdb_EDB-209`	2025-11-11 15:05:25	2025-11-11 08:15:57
EXPLOITDB	`exploitdb_EDB-210`	2025-11-11 15:05:48	2025-11-11 08:16:01
EXPLOITDB	`exploitdb_EDB-215`	2025-11-11 15:05:25	2025-11-11 08:16:21
EXPLOITDB	`exploitdb_EDB-249`	2025-11-11 15:05:25	2025-11-11 08:21:04

版本与语言

当前版本: v14

主要语言: EN

支持语言:

EN ZH

其他标识符:

安全公告

暂无安全公告信息

变更历史

v14 EXPLOITDB

2025-11-11 16:21:04

references_count: 33 → 35; tags_count: 13 → 14

查看详细变更

references_count: 33 -> 35
tags_count: 13 -> 14

v13 EXPLOITDB

2025-11-11 16:16:21

references_count: 31 → 33; tags_count: 12 → 13

查看详细变更

references_count: 31 -> 33
tags_count: 12 -> 13

v12 EXPLOITDB

2025-11-11 16:16:01

references_count: 29 → 31

查看详细变更

references_count: 29 -> 31

v11 EXPLOITDB

2025-11-11 16:15:57

references_count: 27 → 29; tags_count: 11 → 12

查看详细变更

references_count: 27 -> 29
tags_count: 11 -> 12

v10 EXPLOITDB

2025-11-11 16:15:26

references_count: 25 → 27; tags_count: 10 → 11

查看详细变更

references_count: 25 -> 27
tags_count: 10 -> 11

v9 EXPLOITDB

2025-11-11 16:15:26

references_count: 23 → 25; tags_count: 8 → 10

查看详细变更

references_count: 23 -> 25
tags_count: 8 -> 10

v8 EXPLOITDB

2025-11-11 16:15:26

references_count: 21 → 23

查看详细变更

references_count: 21 -> 23

v7 EXPLOITDB

2025-11-11 16:15:26

references_count: 19 → 21; tags_count: 6 → 8

查看详细变更

references_count: 19 -> 21
tags_count: 6 -> 8

v6 EXPLOITDB

2025-11-11 16:15:26

references_count: 17 → 19

查看详细变更

references_count: 17 -> 19

v5 EXPLOITDB

2025-11-11 16:15:26

references_count: 15 → 17; tags_count: 4 → 6

查看详细变更

references_count: 15 -> 17
tags_count: 4 -> 6

v4 EXPLOITDB

2025-11-11 16:15:10

references_count: 12 → 15; tags_count: 0 → 4; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']

查看详细变更

references_count: 12 -> 15
tags_count: 0 -> 4
data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']

v3 CNNVD

2025-11-11 15:48:44

vulnerability_type: 未提取 → 授权问题; cnnvd_id: 未提取 → CNNVD-200011-069; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']

查看详细变更

vulnerability_type: 未提取 -> 授权问题
cnnvd_id: 未提取 -> CNNVD-200011-069
data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']

v2 NVD

2025-11-11 15:40:58

severity: SeverityLevel.MEDIUM → SeverityLevel.CRITICAL; cvss_score: 未提取 → 10.0; cvss_vector: NOT_EXTRACTED → AV:N/AC:L/Au:N/C:C/I:C/A:C; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 74; data_sources: ['cve'] → ['cve', 'nvd']

查看详细变更

severity: SeverityLevel.MEDIUM -> SeverityLevel.CRITICAL
cvss_score: 未提取 -> 10.0
cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:C/I:C/A:C
cvss_version: NOT_EXTRACTED -> 2.0
affected_products_count: 0 -> 74
data_sources: ['cve'] -> ['cve', 'nvd']

CVE-2000-0844 (CNNVD-200011-069)

中文标题:

HP-UX NLSPATH环境变量权限提升漏洞

英文标题:

Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected fo...

漏洞描述

中文描述:

英文描述:

CWE类型:

标签:

受影响产品

解决方案

中文解决方案:

英文解决方案:

临时解决方案:

参考链接

CVSS评分详情

时间信息

利用信息

数据源详情

版本与语言

安全公告

变更历史