VDB
CVE-2002-0638
CVE-2002-0638
PUBLISHED
CVSS 6.199999809265137 MEDIUM
setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh.
EPSS 0.53% · 43.9th percentile
Risk Scores
CVSS 2.0
6.199999809265137
EPSS Score
0.53%
43.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| hp | secure_os | 1.0 |
| mandrakesoft | mandrake_linux | 8.1, 8.1, 8.2 |
| mandrakesoft | mandrake_linux_corporate_server | 1.0.1 |
| redhat | linux | 7.1, 7.1, 7.2 |
| mandrakesoft | mandrake_single_network_firewall | 7.2 |
| n/a | n/a | n/a |
Timeline
- Jul 29, 2002 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 30, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 15, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Jun 2, 2023 EPSS Score
- Jul 25, 2023 EPSS Score
References
- HPSBTL0207-054 vendor-advisory
- RHSA-2002:137 vendor-advisory
- 5344 vdb
- MDKSA-2002:047 vendor-advisory
- 20020729 RAZOR advisory: Linux util-linux chfn local root vulnerability mailing-list
- 5164 vdb
- http://www.iss.net/security_center/static/9709.php technical
- http://www.kb.cert.org/vuls/id/405955 patch
- ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-043.0.txt technical
- http://archives.neohapsis.com/archives/bugtraq/2002-07/0396.html technical
- https://nvd.nist.gov/vuln/detail/CVE-2002-0638 advisory
- http://archives.neohapsis.com/archives/bugtraq/2002-07/0357.html url
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000523 url
- http://rhn.redhat.com/errata/RHSA-2002-132.html url