Unscored severity · published Jan 29, 2004
CVE-2004-2133
Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow local users to execute…
–
CVSS
0.6%
EPSS
No
On KEV
Description
Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow local users to execute arbitrary code by causing cvsup to link against malicious libraries that are created in world-writable directories such as /usr/src/packages.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
Cvsup · Cvsup
cvsup-16.1h-2.i386.rpm; cvsup-16.1h-36.i586.rpm; cvsup-16.1h-43.i586.rpm · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2133
Exploit
http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0025.html
marc.info
http://marc.info/?l=bugtraq&m=107539776002450&w=2
Patch
http://www.securityfocus.com/bid/9523
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/14994
More from Cvsup
–
CVE-2002-2382
cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out