Vulnerability in Paul Jarc Idtools

CVE-2001-1324

cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.

EPSS: 0.003 (25.1th percentile) — read the EPSS interpretation.

Affected products

Paul_jarc Idtools — versions 2001-05-31, 2001-06-08
N/a — versions n/a

References

cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)