Buffer overflow in secure locate (slocate) before 2.7 allows local users to execute arbitrary code via a long (1) -c or (2) -r command line argument.

A problem has been discovered in slocate, a secure locate replacement.
A buffer overflow in the setgid program slocate can be used to execute arbitrary code as group slocate. This can be used to alter the slocate database.

A buffer overflow vulnerability was discovered in slocate by team USG.
The overflow appears when slocate is used with the -c and -r parameters, using a 1024 (or 10240) byte string. This has been corrected in slocate version 2.7.

Updated slocate packages are now available that fix vulnerabilities allowing a local user to gain 'slocate' group privileges.

Slocate is a security-enhanced version of locate, designed to find files on a system via a central database.

Patrik Hornik discovered a vulnerability in Slocate versions up to and including 2.7 where a carefully crafted database could overflow a heap-based buffer. A local user could exploit this vulnerability to gain 'slocate' group privileges and then read the entire slocate database. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0848 to this issue.

Users of Slocate should upgrade to these erratum packages, which contain Slocate version 2.7 with the addition of a patch from Kevin Lindsay that causes slocate to drop privileges before reading a user-supplied database.

For Red Hat Enterprise Linux 2.1 these packages also fix a buffer overflow that affected unpatched versions of Slocate prior to 2.7.
This vulnerability could also allow a local user to gain 'slocate' group privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0056 to this issue.

ID	Name	Product	Family	Severity
15089	Debian DSA-252-1 : slocate - buffer overflow	Nessus	Debian Local Security Checks	high
14000	Mandrake Linux Security Advisory : slocate (MDKSA-2003:015)	Nessus	Mandriva Local Security Checks	high
12457	RHEL 2.1 / 3 : slocate (RHSA-2004:041)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0056

high

Tenable Plugins

high

high

high