|
|
| |
|
| |
Tcl/Tk local root vulnerability
| Package(s): | tcltk expect |
CVE #(s): | CAN-2001-1374
CAN-2001-1375
|
| Created: | August 14, 2002 |
Updated: | September 24, 2002 |
| Description: |
Tcl/Tk searches for its libraries in the current working
directory before other directories.
A local user could
execute arbitrary code by inserting a Trojan horse library
in the current working directory.
Versions of the expect application prior to 5.32, search for its libraries
in /var/tmp before searching in other directories.
A local user could
gain root privleges by inserting a Trojan horse library
in /var/tmp and then getting the root user to run mkpasswd.
|
| Alerts: |
|
( Log in to post comments)
|
|
|