PT-2001-2234 · Netbsd · Netbsd

Published 2001-08-23 · Updated 2017-12-19 · CVE-2001-1091

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 1.4.x through 1.5.1

Description The issue concerns the dump and dump lfs commands, which do not properly drop privileges. This could allow local users to gain privileges via the RCMD CMD environment variable.

Recommendations For NetBSD versions 1.4.x through 1.5.1, consider restricting access to the dump and dump lfs commands until a proper fix is applied to ensure these commands drop privileges correctly. As a temporary workaround, avoid using the RCMD CMD environment variable with these commands to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2001-1091

Affected Products

Netbsd

References · 3

• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-014.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1091 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7037 · Note