CVE-2002-0849 Linux-iSCSI iSCSI implementation installs the iscsi.conf file with world-readable permissions on some operating systems, including Red Hat Linux Limbo Beta #1, which could allow local users to gain pr...

MediumCVSS 4.6 EPSS 0.38%

Published: 2002-08-10 07:00
Updated: 2026-06-17 00:58
Exploit status: No public exploit known

Description

Linux-iSCSI iSCSI implementation installs the iscsi.conf file with world-readable permissions on some operating systems, including Red Hat Linux Limbo Beta #1, which could allow local users to gain privileges by reading the cleartext CHAP password.

Affected products

Product	Affected versions	Fixed in
cisco iscsi driver	All versions	No fix listed

References

20020808 iDEFENSE Security Advisory: iSCSI Default Configuration File Settings mailing-list
20020808 Re: [VulnWatch] iDEFENSE Security Advisory: iSCSI Default Configuration File Settings mailing-list
linux-iscsi-conf-insecure(9792) vdb-entry
5423 vdb-entry

CVSS v2.0

4.6 Medium

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Local
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.38% (percentile 31.9)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.