CVE-2001-1494 script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root exe...
MediumCVSS 5.5
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kernel util-linux | < 2.11n | 2.11n |
| avaya cvlan | All versions | No fix listed |
| avaya integrated management suit | All versions | No fix listed |
| avaya interactive response | All versions | No fix listed |
| avaya intuity lx | All versions | No fix listed |
| avaya message networking | All versions | No fix listed |
| avaya messaging storage server | All versions | No fix listed |
| debian/util-linux(Debian:12) | < 2.11n-1 | 2.11n-1 |
| debian/util-linux(Debian:13) | < 2.11n-1 | 2.11n-1 |
| debian/util-linux(Debian:14) | < 2.11n-1 | 2.11n-1 |
References
- 20011213 Silly 'script' hardlink bug - fixed mailing-list third-party-advisory
- 20011212 Silly 'script' hardlink bug mailing-list third-party-advisory
- 16785 broken-link third-party-advisory
- 18502 broken-link third-party-advisory
- support.avaya.com third-party-advisory
- RHSA-2005:782 broken-link vendor-advisory
- 16280 broken-link third-party-advisory vdb-entry
- util-linux-script-hardlink(7718) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:10723 broken-link signature vdb-entry
- Debian Security Tracker CVE-2001-1494 vendor-advisory