CVE-2004-0368

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-05-04 · updated 2026-06-16
Weakness: CWE-119

Description

Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.

Affected products

IBM AIX: 4.3.3, 5.1, 5.2
Open Group Cde Common Desktop Environment: 1.0.1, 1.0.2, 1.1, 1.2, 2.0, 2.1 (+1)
Xi Graphics Dextop: 2.1, 3.0

References

http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0064.html
http://lists.immunitysec.com/pipermail/dailydave/2004-March/000402.html
http://secunia.com/advisories/11210/
http://secunia.com/advisories/11214/
http://secunia.com/advisories/11495/
http://secunia.com/advisories/11614/
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101478-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57539-1&searchclause=security
http://www.auscert.org.au/render.html?it=4103&cid=3734
http://www.ciac.org/ciac/bulletins/o-129.shtml
http://www.immunitysec.com/downloads/dtlogin.sxw.pdf

Get alerted when CVE-2004-0368 or the next vulnerability affects your stack