CVE-2001-0366

saposcol in SAP R/3 Web Application Server Demo before 1.5 trusts the PATH environmental variable to find and execute the expand program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse expand program.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
ftp://ftp.sap.com/pub/linuxlab/saptools/README.saposcol
http://www.securityfocus.com/archive/1/180498	Exploit Patch Vendor Advisory
http://www.securityfocus.com/bid/2662	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6487

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:sap_r_3_web_application_server_demo::::::::
	cpe:2.3:a:sap:saposcol:1.0::linux:::::
	cpe:2.3:a:sap:saposcol:1.1::linux:::::
	cpe:2.3:a:sap:saposcol:1.2::linux:::::
	cpe:2.3:a:sap:saposcol:1.3::linux:::::

History

No history.

Information

Published : 2001-06-27 04:00

Updated : 2024-02-28 10:24

NVD link : CVE-2001-0366

Mitre link : CVE-2001-0366

CVE.ORG link : CVE-2001-0366

JSON object : View

Products Affected

sap

saposcol
sap_r_3_web_application_server_demo

CWE

NVD-CWE-Other

{"id": "CVE-2001-0366", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2001-06-27T04:00:00.000", "references": [{"url": "ftp://ftp.sap.com/pub/linuxlab/saptools/README.saposcol", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/180498", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/2662", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/6487", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "saposcol in SAP R/3 Web Application Server Demo before 1.5 trusts the PATH environmental variable to find and execute the expand program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse expand program."}], "lastModified": "2017-10-10T01:29:42.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:sap_r_3_web_application_server_demo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "895E8C7B-3CE3-40D3-8899-C0F357C76C6D", "versionEndIncluding": "1.5"}, {"criteria": "cpe:2.3:a:sap:saposcol:1.0:*:linux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C30821CF-2649-4CA2-995E-E2E026637BC2"}, {"criteria": "cpe:2.3:a:sap:saposcol:1.1:*:linux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96C8AD96-0585-49AF-8A61-4346EFADD758"}, {"criteria": "cpe:2.3:a:sap:saposcol:1.2:*:linux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D683E15-9A21-4507-B0E8-0B280899A2A6"}, {"criteria": "cpe:2.3:a:sap:saposcol:1.3:*:linux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB78CC7C-52FC-43C8-B88C-CD54FC9036B1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}