Medium

Buffer Overflow in man-db 2.4.1 and earlier (setuid)

IdentifiersCVE-2003-0620CWE-120

Multiple buffer overflow vulnerabilities exist in man-db 2.4.1 and earlier when installed setuid. The vulnerabilities are present in the handling of several arguments and environment variables: (1) MANDATORY_MANPATH, MANPATH_MAP, and MANDB_MAP arguments to add_to_dirlist in manp.c, (2) long pathnames to ult_src in ult_src.c, (3) long .so arguments to test_for_include in ult_src.c, (4) long MANPATH environment variable, and (5) long PATH environment variable. These overflows can be triggered by local users to overwrite memory and potentially execute arbitrary code with elevated privileges.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows local users to gain elevated privileges, potentially leading to full system compromise if the man-db binary is installed setuid root. Attackers can execute arbitrary code with root privileges by exploiting the buffer overflows.

Mitigation

If you can’t patch tonight, do this now.

As an immediate mitigation, remove the setuid bit from the man-db binary to prevent privilege escalation. Additionally, restrict local user access to the vulnerable binary until a patched version is deployed.

Remediation

Patch, then assume compromise.

Upgrade to a version of man-db later than 2.4.1 where these buffer overflow vulnerabilities have been patched. Ensure that the setuid bit is removed from the man-db binary if not strictly necessary.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Andries BrouwerManapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity