CVE-2001-1324 Privilege escalation in n/a
Local attackers can exploit improper return value checking in idtools to gain elevated privileges via the setstate utility.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2001-1324?
CVE-2001-1324 is a medium-severity vulnerability in n/a, published on 3 May 2002. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
Which versions are affected by CVE-2001-1324?
It affects 1 product.
Products include Paul Jarc Idtools.
How do I fix CVE-2001-1324?
No fix has been published for CVE-2001-1324 yet. Limit exposure of the affected software until one is available.
Is CVE-2001-1324 being exploited?
There is no known exploitation of CVE-2001-1324 in the wild and no public exploit code.
Sources
Also known as GHSA-hvr4-2p3v-j73r.