CVE

Id
4891  
CVE No.
CVE-2002-0499  
Status
Candidate  
Description
The d_path function in Linux kernel 2.2.20 and earlier, and 2.4.18 and earlier, truncates long pathnames without generating an error, which could allow local users to force programs to perform inappropriate operations on the wrong directories.  
Phase
Proposed (20020611)  
Votes
ACCEPT(3) Cole, Foat, Frech | NOOP(3) Armstrong, Cox, Wall | REVIEWING(1) Christey  
Comments
CHANGE> [Cox changed vote from REVIEWING to ACCEPT] | CHANGE> [Cox changed vote from ACCEPT to NOOP] | Christey> Need to investigate this more... is it the responsibility | of the kernel to address this, or the application | programmer?  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
25041 4891 CVE-2002-0499 BUGTRAQ:20020326 d_path() truncating excessive long path name vulnerability  View
25042 4891 CVE-2002-0499 URL:http://www.securityfocus.com/archive/1/264117  View
25043 4891 CVE-2002-0499 MISC:http://www.cs.helsinki.fi/linux/linux-kernel/2002-13/0054.html  View
25044 4891 CVE-2002-0499 BID:4367  View
25045 4891 CVE-2002-0499 URL:http://www.securityfocus.com/bid/4367  View
25046 4891 CVE-2002-0499 XF:linux-dpath-truncate-path(8634)  View
25047 4891 CVE-2002-0499 URL:http://www.iss.net/security_center/static/8634.php  View
25048 4891 CVE-2002-0499 VULNWATCH:20020326 [VulnWatch] d_path() truncating excessive long path name vulnerability  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63740 JVNDB-2002-000067 Linux Kernel の d_path() 関数における任意のディレクトリを参照される脆弱性 Linux Kernel において、dentry が PAGE_SIZE -1 よりも長いパスを受け取った場合に、d_path は連結したパスをバッファに書き込まず、不完全なパスを含むエラーメッセージをユーザ空間プロセスに返す脆弱性が存在します。 CVE-2002-0499 4891 2.1 http://jvndb.jvn.jp/ja/contents/2002/JVNDB-2002-000067.html  View