Vulnerability Details : CVE-2004-2372
Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path. NOTE: some external documents recommend that Bochs be installed setuid root, so this should be treated as a vulnerability.
Vulnerability category: OverflowExecute code
Products affected by CVE-2004-2372
- cpe:2.3:a:bochs_project:bochs:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2004-2372
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2004-2372
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
References for CVE-2004-2372
-
http://sourceforge.net/project/shownotes.php?release_id=215733
Page not found - SourceForge.netPatch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/15309
Bochs long HOME variable buffer overflow CVE-2004-2372 Vulnerability ReportVDB Entry
-
http://www.securiteam.com/unixfocus/5XP0L1FC0M.html
Vulnerability Security Testing & DAST | Fortra's Beyond SecurityExploit;Patch;Vendor Advisory
-
http://securitytracker.com/id?1009219
Access DeniedPatch;Third Party Advisory;VDB Entry
Jump to