CVE-2002-0638
- State
- Published
- Severity
- Not scored
- Published
- Apr 2, 2003
- Updated
- Aug 8, 2024
- Reserved
- Jun 27, 2002
Description
setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 5344vdb-entry
- utillinux-chfn-race-condition(9709)vdb-entry
- MDKSA-2002:047vendor-advisory
- RHSA-2002:132vendor-advisory
- VU#405955third-party-advisory
- 20020729 [VulnWatch] RAZOR advisory: Linux util-linux chfn local root vulnerabilitymailing-list
- CLA-2002:523vendor-advisory
- HPSBTL0207-054vendor-advisory
- 20020730 TSLSA-2002-0064 - util-linuxmailing-list
- 20020729 RAZOR advisory: Linux util-linux chfn local root vulnerabilitymailing-list
- RHSA-2002:137vendor-advisory
- 5164vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.