CVE-2002-1361

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP (Security Hardening Patch) installed allows remote attackers to execute arbitrary code via a POST request with shell metacharacters in the email parameter.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=103912513522807&w=2
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/49377Vendor Advisory
http://www.cert.org/advisories/CA-2002-35.htmlPatch, Third Party Advisory, US Government Resource
http://www.ciac.org/ciac/bulletins/n-025.shtml
http://www.kb.cert.org/vuls/id/810921US Government Resource
http://www.securityfocus.com/bid/6326
https://exchange.xforce.ibmcloud.com/vulnerabilities/10776
http://marc.info/?l=bugtraq&m=103912513522807&w=2
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/49377Vendor Advisory
http://www.cert.org/advisories/CA-2002-35.htmlPatch, Third Party Advisory, US Government Resource
http://www.ciac.org/ciac/bulletins/n-025.shtml
http://www.kb.cert.org/vuls/id/810921US Government Resource
http://www.securityfocus.com/bid/6326
https://exchange.xforce.ibmcloud.com/vulnerabilities/10776

Timeline

Published: Dec 23, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-13625.0mICQ 0.4.9 and earlier allows remote attackers to cause a denial of service (crash) via malformed ICQ message types without a 0xFE separator CVE-2002-13637.5Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to caus CVE-2002-13647.2Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses.CVE-2002-13657.5Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local a CVE-2002-13666.2Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via fi CVE-2002-136710.0Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to add printers without authentication via a certain UDP pa CVE-2002-13687.5Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute a CVE-2002-136910.0jobs.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly use the strncat function call when processing the optio CVE-2002-13717.5filters/image-gif.c in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which al CVE-2002-13727.5Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations, wh CVE-2002-13735.0Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of serv CVE-2002-13747.5The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force