Buffer Overflow Vulnerability in 'man' System Manual Pager Program

vendor:

man

by:

SecurityFocus

7.2

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: man

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2002

Buffer Overflow Vulnerability in ‘man’ System Manual Pager Program

A buffer overflow vulnerability exists in the implementation of the 'man' system manual pager program commonly included with Linux distributions. The vulnerability exists due to the way the program handles manual page files beginning with a '.so' statement. Under certain circumstances, the code responsible for processing this data may be allow the length of the filename from a '.so' statement to be expanded, eventually causing a boundary condition error. As a result, it may be possible for local users to execute arbitrary code with group 'man' privileges.

Mitigation:

Upgrade to the latest version of the 'man' system manual pager program.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2872/info

A buffer overflow vulnerability exists in the implementation of the 'man' system manual pager program commonly included with Linux distributions.

The vulnerability exists due to the way the program handles manual page files beginning with a '.so' statement. Under certain circumstances, the code responsible for processing this data may be allow the length of the filename from a '.so' statement to be expanded, eventually causing a boundary condition error.

As a result, it may be possible for local users to execute arbitrary code with group 'man' privileges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20926.tar.gz