CVE-2000-0693 Command injection in n/a
Local attackers can execute arbitrary commands by manipulating the PATH environment variable to hijack the cp command used by the Raptor GFX configuration tool.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2000-0693?
CVE-2000-0693 is a high-severity command injection vulnerability in n/a, published on 7 May 2001. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
pgxconfig in the Raptor GFX configuration tool uses a relative path name for a system call to the "cp" program, which allows local users to execute arbitrary commands by modifying their path to point to an alternate "cp" program.
Which versions are affected by CVE-2000-0693?
It affects 1 product.
Products include Tech-Source Raptor Gfx Pgx32.
How do I fix CVE-2000-0693?
No fix has been published for CVE-2000-0693 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2000-0693 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2000-0693 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f3h8-8rx5-4v78.