PT-2002-3046 · Joe · Joe

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2334

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Joe text editor versions 2.8 through 2.9.7

Description The issue allows local users to execute arbitrary setuid and setgid root programs when root edits scripts owned by other users, due to the failure to remove the group and user setuid bits for backup files.

Recommendations For Joe text editor versions 2.8 through 2.9.7, consider removing the setuid and setgid bits from backup files manually to prevent exploitation until a proper fix is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2002-2334

Affected Products

Joe

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2334 · Security Note
• http://iss.net/security_center/static/10125.php · Note
• http://online.securityfocus.com/archive/1/292138 · Note
• http://securityfocus.com/bid/5732 · Note