CVE-2002-1160

{"id": "CVE-2002-1160", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2003-02-19T05:00:00.000", "references": [{"url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000693", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=104431622818954&w=2", "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55760", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/11254.php", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/911505", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:017", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2003-028.html", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2003-035.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/6753", "source": "cve@mitre.org"}, {"url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000693", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://marc.info/?l=bugtraq&m=104431622818954&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55760", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.iss.net/security_center/static/11254.php", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kb.cert.org/vuls/id/911505", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:017", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.redhat.com/support/errata/RHSA-2003-028.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.redhat.com/support/errata/RHSA-2003-035.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/6753", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su."}, {"lang": "es", "value": "La configuraci\u00f3n por defecto de pam_xauth en Red Hat Linux 7.1 a 8.0 envia MIT-Magic-Cookies a sesiones X nuevas, lo que podr\u00eda permitir a usuarios locales ganar privilegios de root robando las cookies de un fichero .xauth temporal, que es creado con los credenciales del usuario original despues de que root use el comando su"}], "lastModified": "2024-11-20T23:40:43.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:linux:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D46E093-1C68-43BB-B281-12117EC8DE0F"}, {"criteria": "cpe:2.3:o:redhat:linux:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E562907F-D915-4030-847A-3C6834A80D4E"}, {"criteria": "cpe:2.3:o:redhat:linux:7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "138985E6-5107-4E8B-A801-C3D5FE075227"}, {"criteria": "cpe:2.3:o:redhat:linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "038FEDE7-986F-4CA5-9003-BA68352B87D4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}