CVE-2004-0793 The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, which allows attackers to execute arbitrary commands via a calendar event file.
HighCVSS 7.2
EPSS 0.56%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, which allows attackers to execute arbitrary commands via a calendar event file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian bsdmainutils | = 6.0 | No fix listed |
| debian bsdmainutils | = 6.0.1 | No fix listed |
| debian bsdmainutils | = 6.0.2 | No fix listed |
| debian bsdmainutils | = 6.0.3 | No fix listed |
| debian bsdmainutils | = 6.0.4 | No fix listed |
| debian bsdmainutils | = 6.0.5 | No fix listed |
| debian bsdmainutils | = 6.0.6 | No fix listed |
| debian bsdmainutils | = 6.0.7 | No fix listed |
| debian bsdmainutils | = 6.0.8 | No fix listed |
| debian bsdmainutils | = 6.0.9 | No fix listed |
| debian bsdmainutils | = 6.0.10 | No fix listed |
| debian bsdmainutils | = 6.0.11 | No fix listed |
| debian bsdmainutils | = 6.0.12 | No fix listed |
| debian bsdmainutils | = 6.0.13 | No fix listed |
| debian bsdmainutils | = 6.0.14 | No fix listed |
| debian bsdmainutils(Debian:12) | < 6.0.15 | 6.0.15 |
| debian bsdmainutils(Debian:13) | < 6.0.15 | 6.0.15 |
| debian bsdmainutils(Debian:14) | < 6.0.15 | 6.0.15 |
References
- 20040830 Possible root compromose with bsdmainutils 6.0.x < 6.0.15 (Debian testing/unstable) mailing-list
- 11077 exploit patch vdb-entry vendor-advisory
- bsdmainutils-calendar-gain-privileges(17162) vdb-entry
- Debian Security Tracker CVE-2004-0793 vendor-advisory