CVE-2005-1394

Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environment variable to (1) wservice or (2) lockmgr.

Published Bycve@mitre.org

Published DateMay 03, 2005, 04:00

Weakness Type (CWE):CWE-134

CVSS Metrics

Base Score

7.2

Vector String

AV:L/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE

References

http://marc.info/?l=full-disclosure&m=111489411524630&w=2
http://secunia.com/advisories/15196
http://securitytracker.com/id?1013852
http://support.esri.com/index.cfm?fa=downloads.patchesServicePacks.viewPatch&PID=14&MetaID=1015
http://www.digitalmunition.com/DMA%5B2005-0425a%5D.txt

Weakness Type (CWE):CWE-134

CVSS Metrics

Base Score

7.2

Vector String

AV:L/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE