CVE-2001-1256 - kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable file

CVE-2001-1256

Summary

kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable files via a symlink attack on the (1) /tmp/.kmmodreg_lock and (2) /tmp/kmpath.tmp temporary files.

References

Vulnerable Configurations

cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:11.04:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:11.04:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*

CVSS

Base:	1.2 (as of 19-12-2017 - 02:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:L/AC:H/Au:N/C:N/I:P/A:N

oval via4

accepted

2014-03-24T04:01:43.510-04:00

class

vulnerability

contributors

name Michael Wood
organization Hewlett-Packard
name Sushant Kumar Singh
organization Hewlett-Packard

description

kmmodreg in HP-UX 11.11, 11.04 and 11.00 allows local users to create arbitrary world-writeable files via a symlink attack on the (1) /tmp/.kmmodreg_lock and (2) /tmp/kmpath.tmp temporary files.

family

unix

oval:org.mitre.oval:def:5628

status

accepted

submitted

2008-07-10T16:22:36.000-04:00

title

HP-UX kmmodreg (1M), Local Denial of Service (DoS), Increased Privilege

version

refmap via4

bid	2821
bugtraq	20010604 yet another sym link followers
cert-vn	VU#127435
ciac	L-093
confirm	http://www.kb.cert.org/vuls/id/TJSL-4Z5Q92
hp	HPSBUX0106-153
xf	hpux-kmmodreg-symlink(6656)

Last major update

19-12-2017 - 02:29

Published

11-06-2001 - 04:00

Last modified

19-12-2017 - 02:29