CVE-2002-0499 Path traversal in n/a
Local attackers can exploit pathname truncation in the Linux kernel to force programs to operate on incorrect directories, potentially leading to unauthorized data modification or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2002-0499?
CVE-2002-0499 is a low-severity path traversal vulnerability in Linux kernel, published on 11 Jun 2002. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The d_path function in Linux kernel 2.2.20 and earlier, and 2.4.18 and earlier, truncates long pathnames without generating an error, which could allow local users to force programs to perform inappropriate operations on the wrong directories.
Which versions are affected by CVE-2002-0499?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2002-0499?
No fix has been published for CVE-2002-0499 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2002-0499 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-0499 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Linux kernel
Sources
Also known as GHSA-xh92-g23r-644g.