CVE-2001-0825

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Buffer overflow in internal string handling routines of xinetd before 2.1.8.8 allows remote attackers to execute arbitrary commands via a length argument of zero or less, which disables the length check.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000406Patch, Vendor Advisory
http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-029-01
http://www.redhat.com/support/errata/RHSA-2001-092.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/2971Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6804
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000406Patch, Vendor Advisory
http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-029-01
http://www.redhat.com/support/errata/RHSA-2001-092.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/2971Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6804

Timeline

Published: Dec 6, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-08267.5Buffer overflows in CesarFTPD 0.98b allows remote attackers to execute arbitrary commands via long arguments to (1) HELP, (2) USER, (3) PASS CVE-2001-08277.5Cerberus FTP server 1.0 - 1.5 allows remote attackers to cause a denial of service (crash) via a large number of "PASV" requests.CVE-2001-08285.1A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink CVE-2001-08295.1A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, w CVE-2001-08307.56tunnel 0.08 and earlier does not properly close sockets that were initiated by a client, which allows remote attackers to cause a denial of CVE-2001-08314.6Unknown vulnerability in Oracle Label Security in Oracle 8.1.7 and 9.0.1, when audit functionality, SET_LABEL, or SQL*Predicate is being use CVE-2001-08322.1Vulnerability in Oracle 8.0.x through 9.0.1 on Unix allows local users to overwrite arbitrary files, possibly via a symlink attack or incorr CVE-2001-08337.2Buffer overflow in otrcrep in Oracle 8.0.x through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment var CVE-2001-08346.4htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuratio CVE-2001-08357.5Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attackers to inject arbitrary HTML tags CVE-2001-08367.5Buffer overflow in Oracle9iAS Web Cache 2.0.0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request.CVE-2001-08372.1DeltaThree Pc-To-Phone 3.0.3 places sensitive data in world-readable locations in the installation directory, which allows local users to re