Vulnerability in Krzysztof Dabrowski Cmd5checkpw

CVE-2005-0580

cmd5checkpw, when running setuid, does not properly drop privileges before calling the execvp function, which allows local users to read the poppasswd file.

EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.

Affected products

Krzysztof_dabrowski Cmd5checkpw — versions 0.20, 0.21, 0.22
N/a — versions n/a

References

cve@mitre.org (vendor-advisory, x_refsource_GENTOO, Vendor Advisory)