PT-2002-1009 · Debian · Xtell

Published 2002-05-03 · Updated 2016-10-18 · CVE-2002-0333

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xtell versions 1.91.1 and earlier xtell versions 2.x before 2.7

Description The issue concerns multiple vulnerabilities in the xtell package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. A directory traversal vulnerability in xtell (xtelld) allows remote attackers to read files with short names by using a .. in the TTY argument. Local users can also read more files using a symlink with a short name.

Recommendations For versions 1.91.1 and earlier, update to a version later than 1.91.1 to resolve the issue. For versions 2.x before 2.7, update to version 2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the TTY argument to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-02180

CVE-2002-0333

Affected Products

Xtell

References · 11

• 🔥 http://iss.net/security_center/static/8313.php · Exploit
• 🔥 https://exploit-db.com/exploits/21310 · Exploit
• 🔥 http://securityfocus.com/bid/4194 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0333 · Security Note
• https://bdu.fstec.ru/vul/2015-02180 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2002-0333 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0332 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0334 · Security Note
• http://debian.org/security/2002/dsa-121 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=101494896516467&w=2 · Note
• http://debian.org/security/dsa-121 · Note