SB2013060702 - Format string error in Linux kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2013060702

SB2013060702 - Format string error in Linux kernel

Published: June 7, 2013 Updated: August 11, 2020

Security Bulletin ID SB2013060702
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Format string error (CVE-ID: CVE-2013-2852)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.


Remediation

Install update from vendor's website.

References