CVE-2002-1576 lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called....
HighCVSS 7.2
EPSS 0.90%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap db | = 7.3.00 | No fix listed |
References
- 20021204 SAP database local root via symlink mailing-list
- www.sapdb.org patch
- 6316 exploit patch vdb-entry vendor-advisory
- sap-db-lserversrv-symlink(10762) vdb-entry