Lucene search

[email protected]CVE-2001-1091

HistoryMar 15, 2002 - 5:00 a.m.

CVE-2001-1091

2002-03-1505:00:00

[email protected]

web.nvd.nist.gov

netbsd

privilege escalation

cve-2001-1091

local users

environment variable

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.9%

JSON

The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable.

Affected configurations

NVD

Node

netbsdnetbsdMatch1.4

netbsdnetbsdMatch1.4.1

netbsdnetbsdMatch1.4.2

netbsdnetbsdMatch1.4.3

netbsdnetbsdMatch1.5

netbsdnetbsdMatch1.5.1

CPENameOperatorVersion
netbsd:netbsdnetbsdeq1.4
netbsd:netbsdnetbsdeq1.4.1
netbsd:netbsdnetbsdeq1.4.2
netbsd:netbsdnetbsdeq1.4.3
netbsd:netbsdnetbsdeq1.5
netbsd:netbsdnetbsdeq1.5.1

CPE	Name	Operator	Version
netbsd:netbsd	netbsd	eq	1.4
netbsd:netbsd	netbsd	eq	1.4.1
netbsd:netbsd	netbsd	eq	1.4.2
netbsd:netbsd	netbsd	eq	1.4.3
netbsd:netbsd	netbsd	eq	1.5
netbsd:netbsd	netbsd	eq	1.5.1

References

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-014.txt.asc

exchange.xforce.ibmcloud.com/vulnerabilities/7037

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.9%

JSON

Related for CVE-2001-1091

nvd1 cvelist1