Home  >  CVE-2004-0850
CVE Details for CVE: CVE-2004-0850
Summary
Star before 1.5_alpha46 does not drop the effective user ID (euid) before calling external programs, which could allow local users to gain privileges by modifying the RSH environment variable to reference a malicious program.
Timestamps
Last major update 11-07-2017 - 01:30
Published 23-12-2004 - 05:00
Last modified 11-07-2017 - 01:30
References
Vulnerable Configurations
  • cpe:2.3:a:joerg_schilling:star_tape_archiver:1.5_a45:*:*:*:*:*:*:*
    cpe:2.3:a:joerg_schilling:star_tape_archiver:1.5_a45:*:*:*:*:*:*:*
CAPEC
Click the CAPEC title to display a description
CWE
NVD-CWE-Other
CVSS
Base
7.2
Impact
10.0
Exploitability
3.9
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
CVSS3
None
VIA4 references
cvss-vector via4
AV:L/AC:L/Au:N/C:C/I:C/A:C
refmap via4
bid 11141
cert-vn VU#339089
gentoo GLSA-200409-11
sectrack 1011195
xf star-ssh-gain-privileges(17297)