CVE-2003-0372

Nessus < 2.0.6 - Denial of Service and Possible Code Execution via Negative Argument in insstr Function

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2003-0372. PoCs published by Sir Mordred.

AI-analyzed exploit summary This exploit demonstrates a sandbox escape in the 'libnasl' library used by Nessus, allowing arbitrary command execution via malicious NASL scripts. It leverages buffer overflow techniques in functions like 'insstr', 'scanner_add_port', and 'ftp_log_in'.

Description

Signed integer vulnerability in libnasl in Nessus before 2.0.6 allows local users with plugin upload privileges to cause a denial of service (core dump) and possibly execute arbitrary code by causing a negative argument to be provided to the insstr function as used in a NASL script.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Sir Mordred · textdosmultiple
https://www.exploit-db.com/exploits/22634

This exploit demonstrates a sandbox escape in the 'libnasl' library used by Nessus, allowing arbitrary command execution via malicious NASL scripts. It leverages buffer overflow techniques in functions like 'insstr', 'scanner_add_port', and 'ftp_log_in'.

Classification
Working Poc 80%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Nessus with libnasl library (versions affected by CVE-2003-0372)
Auth required
Prerequisites: Nessus server with 'plugins_upload' option enabled · Ability to upload a malicious NASL script
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=105364059803427&w=2
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=105369506714849&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/7664

Scores

EPSS 0.0089
EPSS Percentile 54.8%

Details

CWE
CWE-189
Status published
Products (1)
nessus/nessus < 2.0.5
Published Jun 16, 2003
Tracked Since Feb 18, 2026