PT-2000-1009 · Red Hat · Tmpwatch

Published 2000-10-06 · Updated 2017-10-10 · CVE-2000-0816

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions tmpwatch version 2.6.2

Description The issue concerns multiple vulnerabilities in the tmpwatch package of Red Hat Linux, which can lead to disruption of protected information availability. These vulnerabilities can be exploited locally. Specifically, the --fuser option in Linux tmpwatch allows local users to execute arbitrary commands by creating files whose names contain shell metacharacters.

Recommendations For tmpwatch version 2.6.2, consider restricting access to the --fuser option to prevent local users from executing arbitrary commands until a patch is available. As a temporary workaround, avoid using the --fuser option in tmpwatch to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-07927

CVE-2000-0816

Affected Products

Tmpwatch

References · 9

• 🔥 https://exploit-db.com/exploits/20285 · Exploit
• https://bdu.fstec.ru/vul/2015-07927 · Security Note
• http://xforce.iss.net/alerts/advise64.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0816 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5320 · Note
• https://rhn.redhat.com/errata/RHSA-2000-080.html · Note
• http://linux-mandrake.com/en/security/MDKSA-2000-056.php3?dis=7.1 · Note
• http://securityfocus.com/bid/1785 · Note
• http://redhat.com/support/errata/RHSA-2000-080.html · Note