CVE-ID

CVE-2002-0105

• Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
CDE dtlogin in Caldera UnixWare 7.1.0, and possibly other operating systems, allows local users to gain privileges via a symlink attack on /var/dt/Xerrors since /var/dt is world-writable.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
Date Entry Created
20020315 Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Proposed (20020315)
Votes (Legacy)
ACCEPT(2) Frech, Green
NOOP(4) Cole, Foat, Wall, Ziese
REVIEWING(1) Christey
Comments (Legacy)
 Christey> CALDERA:CSSA-2002-SCO.18
   XF:cde-dt-world-writable(9045)
   URL:http://www.iss.net/security_center/static/9045.php
   Note: the advisory sort-of implies that world-write
   permissions were the key problem, so the fact that a symlink
   attack could take place did not necessarily mean that a
   symlink following vulnerability really existed, in the sense
   that symlink attacks don't exist in directories that are
   not writable by other users (well, without those users
   exploiting some *other* vulnerability to allow them to create
   the symlink!)
 CHANGE> [Christey changed vote from NOOP to REVIEWING]
 Christey> Hmmm... should XF:cde-dt-world-writable(9045) really be added
   here?  ISS may have "split" between the permissions issue
   and the symlink problem.

Proposed (Legacy)
20020315
This is an entry on the CVE list, which standardizes names for security problems.