CVE-2004-0233

2004-08-1804:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

utempter

cve-2004-0233

device names

directory traversal

symlink attack

security vulnerability

nvd

6.1 Medium

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

9.2%

JSON

Utempter allows device names that contain … (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.

CPENameOperatorVersion
sgi:propacksgi propackeq3.0
utempter:utempterutemptereq0.5.2
utempter:utempterutemptereq0.5.3
sgi:propacksgi propackeq2.4
slackware:slackware_linuxslackware slackware linuxeq9.1
slackware:slackware_linuxslackware slackware linuxeq*

CPE	Name	Operator	Version
sgi:propack	sgi propack	eq	3.0
utempter:utempter	utempter	eq	0.5.2
utempter:utempter	utempter	eq	0.5.3
sgi:propack	sgi propack	eq	2.4
slackware:slackware_linux	slackware slackware linux	eq	9.1
slackware:slackware_linux	slackware slackware linux	eq	*