Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative "pathlen" value to be used.

A vulnerability was discovered in slocate, a program to index and search for files, whereby a specially crafted database could overflow a heap-based buffer. This vulnerability could be exploited by a local attacker to gain the privileges of the 'slocate' group, which can access the global database containing a list of pathnames of all files on the system, including those which should only be visible to privileged users.

This problem, and a category of potential similar problems, have been fixed by modifying slocate to drop privileges before reading a user-supplied database.

A vulnerability was discovered by Patrik Hornik in slocate versions up to and including 2.7 where a carefully crafted database could overflow a heap-based buffer. This could be exploited by a local user to gain privileges of the 'slocate' group. The updated packages contain a patch from Kevin Lindsay that causes slocate to drop privileges before reading a user-supplied database.

Patrik Hornik discovered a vulnerability in Slocate versions up to and including 2.7 where a carefully crafted database could overflow a heap-based buffer. A local user could exploit this vulnerability to gain 'slocate' group privileges and then read the entire slocate database. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0848 to this issue.
Users of Slocate should upgrade to these packages which contain a patch from Kevin Lindsay which causes slocate to drop privileges before reading a user-supplied database.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated slocate packages are now available that fix vulnerabilities allowing a local user to gain 'slocate' group privileges.

Slocate is a security-enhanced version of locate, designed to find files on a system via a central database.

Patrik Hornik discovered a vulnerability in Slocate versions up to and including 2.7 where a carefully crafted database could overflow a heap-based buffer. A local user could exploit this vulnerability to gain 'slocate' group privileges and then read the entire slocate database. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0848 to this issue.

Users of Slocate should upgrade to these erratum packages, which contain Slocate version 2.7 with the addition of a patch from Kevin Lindsay that causes slocate to drop privileges before reading a user-supplied database.

For Red Hat Enterprise Linux 2.1 these packages also fix a buffer overflow that affected unpatched versions of Slocate prior to 2.7.
This vulnerability could also allow a local user to gain 'slocate' group privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0056 to this issue.

ID	Name	Product	Family	Severity
15265	Debian DSA-428-1 : slocate - buffer overflow	Nessus	Debian Local Security Checks	medium
14104	Mandrake Linux Security Advisory : slocate (MDKSA-2004:004)	Nessus	Mandriva Local Security Checks	medium
13672	Fedora Core 1 : slocate-2.7-4 (2004-059)	Nessus	Fedora Local Security Checks	medium
12457	RHEL 2.1 / 3 : slocate (RHSA-2004:041)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0848

critical

Tenable Plugins

medium

medium

medium

high