1. CVE-Search
  2. CVE-2004-0233
ID CVE-2004-0233
Summary Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.
References
Vulnerable Configurations
  • cpe:2.3:a:sgi:propack:2.4:*:*:*:*:*:*:*
    cpe:2.3:a:sgi:propack:2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:utempter:utempter:0.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:utempter:utempter:0.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:utempter:utempter:0.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:utempter:utempter:0.5.3:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:*:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:*:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:9.1:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:9.1:*:*:*:*:*:*:*
CVSS
Base: 2.1 (as of 11-10-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:L/AC:L/Au:N/C:N/I:P/A:N
oval via4
  • accepted 2013-04-29T04:01:51.280-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    description Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.
    family unix
    id oval:org.mitre.oval:def:10115
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.
    version 30
  • accepted 2004-07-12T12:00:00.000-04:00
    class vulnerability
    contributors
    name Jay Beale
    organization Bastille Linux
    description Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.
    family unix
    id oval:org.mitre.oval:def:979
    status accepted
    submitted 2004-06-10T12:00:00.000-04:00
    title Utempter Directory Traversal Vulnerability
    version 3
redhat via4
advisories
  • rhsa
    id RHSA-2004:174
  • rhsa
    id RHSA-2004:175
rpms
  • utempter-0:0.5.5-1.3EL.0
  • utempter-debuginfo-0:0.5.5-1.3EL.0
refmap via4
bid 10178
gentoo GLSA-200405-05
mandrake MDKSA-2004:031
slackware SSA:2004-110
sunalert 1000752
xf utemper-symlink(15904)
Last major update 11-10-2017 - 01:29
Published 18-08-2004 - 04:00
Last modified 11-10-2017 - 01:29
Back to Top