VDB
CVE-2002-1160
CVE-2002-1160
PUBLISHED
CVSS 7.199999809265137 HIGH
The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su.
EPSS 0.43% · 36.3th percentile
Risk Scores
CVSS 2.0
7.199999809265137
EPSS Score
0.43%
36.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | linux | 7.1, 7.3, 8.0 |
| n/a | n/a | n/a |
Timeline
- Feb 19, 2003 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 30, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 15, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Jun 2, 2023 EPSS Score
References
- VU#911505 third-party-advisory
- CLA-2003:693 vendor-advisory
- linux-pamxauth-gain-privileges(11254) vdb
- MDKSA-2003:017 vendor-advisory
- 55760 vendor-advisory
- RHSA-2003:035 vendor-advisory
- http://marc.info/?l=bugtraq&m=104431622818954&w=2 technical
- http://www.redhat.com/support/errata/RHSA-2003-028.html technical
- http://www.securityfocus.com/bid/6753 technical
- https://nvd.nist.gov/vuln/detail/CVE-2002-1160 advisory