CVE-2003-0265 - Race condition in SDBINST for SAP database 7.3.0.29 creates critical files with world-writable permi

CVE-2003-0265

Summary

Race condition in SDBINST for SAP database 7.3.0.29 creates critical files with world-writable permissions before initializing the setuid bits, which allows local attackers to gain root privileges by modifying the files before the permissions are changed.

References

http://marc.info/?l=bugtraq&m=105232424810097&w=2
http://www.securityfocus.com/bid/7421

Vulnerable Configurations

cpe:2.3:a:sap:sap_db:7.3.29:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_db:7.3.29:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_db:7.4.3.7_beta:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_db:7.4.3.7_beta:*:*:*:*:*:*:*

CVSS

Base:	6.2 (as of 18-10-2016 - 02:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:H/Au:N/C:C/I:C/A:C

refmap via4

bid	7421
bugtraq	20030507 SAP database local root vulnerability during installation. (fwd)

Last major update

18-10-2016 - 02:31

Published

27-05-2003 - 04:00

Last modified

18-10-2016 - 02:31