VICE memory dump command format string attack
| vice-memory-dump-format-string (16404) |  High Risk |
Description:
VICE is vulnerable to a format string attack, caused by a vulnerability when handling the memory dump command. By supplying specially-crafted format string specifiers and then issuing the memory dump command, a local attacker could cause the program to crash or possibly execute arbitrary code on the system.
Consequences:
Gain Privileges
Remedy:
Upgrade to the latest version of VICE, when it becomes available from the VICE Web site. See References.
— OR —
Apply the unofficial patch for this vulnerability, available from the Full-Disclosure Mailing List posting dated Mon Jun 14 2004 - 00:54:02 CDT . See References.
References:
- Full-Disclosure Mailing List, Mon Jun 14 2004 - 00:54:02 CDT : VICE emulator format string vulnerability.
- VICE Web site: The VICE Emulator.
- BID-10543: VICE Monitor Memory Dump Format String Vulnerability
- CVE-2004-0453: Format string vulnerability in the monitor memory dump command in VICE 1.6 to 1.14 allows local users to cause a denial of service (emulator crash) and possibly execute arbitrary code via format string specifiers in an output string.
Platforms Affected:
- viceteam VICE 1.6 - 1.14
Reported:
Jun 14, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net