cvmlogin and statfile in Paul Jarc idtools before 2001.06...
Moderate severity
Unreviewed
Published
Apr 30, 2022
to the GitHub Advisory Database
•
Updated Jan 30, 2023
Description
Published by the National Vulnerability Database
Jun 26, 2001
Published to the GitHub Advisory Database
Apr 30, 2022
Last updated
Jan 30, 2023
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
References