VAR-200208-0247
Vulnerability from variot - Updated: 2025-04-03 22:40setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh. The util-linux package contains a race condition vulnerability that can be used to elevate privileges on the system. The util-linux package is a set of commonly used system utilities such as 'chfn' and 'chsh'. It is included with many Linux distributions. The condition is related to file locking. Failure to check for the existence of a lockfile prior to sensitive operations may, under specific circumstances, open a window of opportunity for attack. The util-linux utilities often write to sensitive files such as /etc/passwd/. The reported attacks are complex, time dependent and require specific circumstances such as system administrator interaction and a large passwd file. Red Hat Linux is known to ship with util-linux as a core component. Other distributions, those that are derived from Red Hat in particular, may also be vulnerable. It should be noted that the utilities included with the shadow-utils package (shipped with SuSE Linux) are not vulnerable. The util-linux tool contains multiple tools for performing Linux system functions. For example, the \'\'chfn\'\' tool allows users to modify personal information stored in the /etc/passwd file. To modify this file, the application needs to use Install with setuid root privileges. Under certain conditions, by using the complex file lock and modification operation loopholes in the login-utils/setpwnam.c code in the util-linux tool, the carefully constructed attack sequence can be modified by using the race condition loopholes such as the /etc/passwd file. Privilege escalation. However, to successfully exploit this vulnerability and perform privilege escalation requires some interaction with the administrator. In addition, the password file must exceed 4K bytes, and when a local attacker modifies the /etc/passwd file, the modified entry cannot be placed in the last part of the 4K bytes of the password file
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200208-0247",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linux",
"scope": "eq",
"trust": 1.9,
"vendor": "redhat",
"version": "7.2"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.9,
"vendor": "redhat",
"version": "7.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.9,
"vendor": "redhat",
"version": "6.1"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.9,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.9,
"vendor": "redhat",
"version": "6.2"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.3,
"vendor": "redhat",
"version": "7.3"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.3,
"vendor": "redhat",
"version": "7.1"
},
{
"model": "mandrake single network firewall",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "7.2"
},
{
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "7.2"
},
{
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "7.1"
},
{
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "8.0"
},
{
"model": "mandrake linux corporate server",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "1.0.1"
},
{
"model": "secure os",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "1.0"
},
{
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "8.1"
},
{
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "7.0"
},
{
"model": "mandrake linux",
"scope": "eq",
"trust": 1.0,
"vendor": "mandrakesoft",
"version": "8.2"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "red hat",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "the sco group sco linux",
"version": null
},
{
"model": "cobalt raq2",
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"model": "cobalt raq3",
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"model": "cobalt raq4",
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"model": "cobalt raq550",
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"model": "cobalt raqxtr",
"scope": null,
"trust": 0.8,
"vendor": "sun microsystems",
"version": null
},
{
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6.2"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "7.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "7.1"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "7.2"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "7.3"
},
{
"model": "util-linux-2.11n-12.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "util-linux-2.10s-12.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "util-linux-2.10m-12.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "util-linux-2.10f-7.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "mount-2.11n-12.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "losetup-2.11n-12.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "linux ia64",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.2"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.2"
},
{
"model": "linux ia64",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.1"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.1"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.0"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.2"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.2"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.1"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.1"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "linux mandrake ppc",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "8.2"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "8.2"
},
{
"model": "linux mandrake ia64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "8.1"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "8.1"
},
{
"model": "linux mandrake ppc",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "8.0"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "8.0"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "7.2"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "7.1"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "7.0"
},
{
"model": "single network firewall",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "7.2"
},
{
"model": "corporate server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "1.0.1"
},
{
"model": "secure os software for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "1.0"
},
{
"model": "openlinux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "3.1.1"
},
{
"model": "openlinux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "3.1"
},
{
"model": "openlinux server",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "3.1.1"
},
{
"model": "openlinux server",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "3.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#405955"
},
{
"db": "BID",
"id": "5344"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
},
{
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:sun:sun_cobalt_raq_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:sun:sun_cobalt_raq_3",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:sun:sun_cobalt_raq_4",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:sun:sun_cobalt_raq_550",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:sun:sun_cobalt_raq_xtr",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:redhat:linux",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michal Zalewski\u203b lcamtuf@echelon.pl",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
}
],
"trust": 0.6
},
"cve": "CVE-2002-0638",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 1.9,
"id": "CVE-2002-0638",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 1.9,
"id": "VHN-5029",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:H/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2002-0638",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#405955",
"trust": 0.8,
"value": "10.97"
},
{
"author": "NVD",
"id": "CVE-2002-0638",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200208-115",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-5029",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#405955"
},
{
"db": "VULHUB",
"id": "VHN-5029"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
},
{
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh. The util-linux package contains a race condition vulnerability that can be used to elevate privileges on the system. The util-linux package is a set of commonly used system utilities such as \u0027chfn\u0027 and \u0027chsh\u0027. It is included with many Linux distributions. The condition is related to file locking. Failure to check for the existence of a lockfile prior to sensitive operations may, under specific circumstances, open a window of opportunity for attack. The util-linux utilities often write to sensitive files such as /etc/passwd/. \nThe reported attacks are complex, time dependent and require specific circumstances such as system administrator interaction and a large passwd file. \nRed Hat Linux is known to ship with util-linux as a core component. Other distributions, those that are derived from Red Hat in particular, may also be vulnerable. \nIt should be noted that the utilities included with the shadow-utils package (shipped with SuSE Linux) are not vulnerable. The util-linux tool contains multiple tools for performing Linux system functions. For example, the \\\u0027\\\u0027chfn\\\u0027\\\u0027 tool allows users to modify personal information stored in the /etc/passwd file. To modify this file, the application needs to use Install with setuid root privileges. Under certain conditions, by using the complex file lock and modification operation loopholes in the login-utils/setpwnam.c code in the util-linux tool, the carefully constructed attack sequence can be modified by using the race condition loopholes such as the /etc/passwd file. Privilege escalation. However, to successfully exploit this vulnerability and perform privilege escalation requires some interaction with the administrator. In addition, the password file must exceed 4K bytes, and when a local attacker modifies the /etc/passwd file, the modified entry cannot be placed in the last part of the 4K bytes of the password file",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0638"
},
{
"db": "CERT/CC",
"id": "VU#405955"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"db": "BID",
"id": "5344"
},
{
"db": "VULHUB",
"id": "VHN-5029"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#405955",
"trust": 3.3
},
{
"db": "BID",
"id": "5344",
"trust": 2.8
},
{
"db": "NVD",
"id": "CVE-2002-0638",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "5164",
"trust": 1.7
},
{
"db": "XF",
"id": "9709",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000170",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200208-115",
"trust": 0.7
},
{
"db": "REDHAT",
"id": "RHSA-2002:132",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2002:137",
"trust": 0.6
},
{
"db": "CONECTIVA",
"id": "CLA-2002:523",
"trust": 0.6
},
{
"db": "MANDRAKE",
"id": "MDKSA-2002:047",
"trust": 0.6
},
{
"db": "CALDERA",
"id": "CSSA-2002-043.0",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20020729 RAZOR ADVISORY: LINUX UTIL-LINUX CHFN LOCAL ROOT VULNERABILITY",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20020730 TSLSA-2002-0064 - UTIL-LINUX",
"trust": 0.6
},
{
"db": "HP",
"id": "HPSBTL0207-054",
"trust": 0.6
},
{
"db": "VULNWATCH",
"id": "20020729 [VULNWATCH] RAZOR ADVISORY: LINUX UTIL-LINUX CHFN LOCAL ROOT VULNERABILITY",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-5029",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#405955"
},
{
"db": "VULHUB",
"id": "VHN-5029"
},
{
"db": "BID",
"id": "5344"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
},
{
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"id": "VAR-200208-0247",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-5029"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-03T22:40:44.719000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "RHSA-2002:132",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/RHSA-2002-132.html"
},
{
"title": "Sun Cobalt RaQ 3 Patches",
"trust": 0.8,
"url": "http://sunsolve.sun.com/patches/cobalt/raq3.eng.html"
},
{
"title": "Sun Cobalt RaQ 4 Patches",
"trust": 0.8,
"url": "http://sunsolve.sun.com/patches/cobalt/raq4.eng.html"
},
{
"title": "RHSA-2002:132",
"trust": 0.8,
"url": "http://www.jp.redhat.com/support/errata/RHSA/RHSA-2002-132J.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/5344"
},
{
"trust": 2.5,
"url": "http://www.kb.cert.org/vuls/id/405955"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-07/0396.html"
},
{
"trust": 1.7,
"url": "ftp://ftp.caldera.com/pub/security/openlinux/cssa-2002-043.0.txt"
},
{
"trust": 1.7,
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000523"
},
{
"trust": 1.7,
"url": "http://online.securityfocus.com/advisories/4320"
},
{
"trust": 1.7,
"url": "http://www.linux-mandrake.com/en/security/2002/mdksa-2002-047.php"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/5164"
},
{
"trust": 1.7,
"url": "http://rhn.redhat.com/errata/rhsa-2002-132.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2002-137.html"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-07/0357.html"
},
{
"trust": 1.7,
"url": "http://www.iss.net/security_center/static/9709.php"
},
{
"trust": 1.1,
"url": "http://marc.info/?l=bugtraq\u0026m=102795787713996\u0026w=2"
},
{
"trust": 0.8,
"url": "about vulnerability notes"
},
{
"trust": 0.8,
"url": "contact us about this vulnerability"
},
{
"trust": 0.8,
"url": "provide a vendor statement"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-0638"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/xforce/xfdb/9709"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-0638"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=102795787713996\u0026w=2"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#405955"
},
{
"db": "VULHUB",
"id": "VHN-5029"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
},
{
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#405955"
},
{
"db": "VULHUB",
"id": "VHN-5029"
},
{
"db": "BID",
"id": "5344"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
},
{
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2002-07-29T00:00:00",
"db": "CERT/CC",
"id": "VU#405955"
},
{
"date": "2002-08-12T00:00:00",
"db": "VULHUB",
"id": "VHN-5029"
},
{
"date": "2002-07-29T00:00:00",
"db": "BID",
"id": "5344"
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"date": "2002-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200208-115"
},
{
"date": "2002-08-12T04:00:00",
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2003-05-30T00:00:00",
"db": "CERT/CC",
"id": "VU#405955"
},
{
"date": "2016-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-5029"
},
{
"date": "2002-07-29T00:00:00",
"db": "BID",
"id": "5344"
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2002-000170"
},
{
"date": "2005-05-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200208-115"
},
{
"date": "2025-04-03T01:03:51.193000",
"db": "NVD",
"id": "CVE-2002-0638"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "5344"
},
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "util-linux package vulnerable to privilege escalation when \"ptmptmp\" file is not removed properly when using \"chfn\" utility",
"sources": [
{
"db": "CERT/CC",
"id": "VU#405955"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "competitive condition",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200208-115"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.