Published: 16/05/2000 Updated: 10/09/2008

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 725

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

The KDE kscd program does not drop privileges when executing a program specified in a user's SHELL environmental variable, which allows the user to gain privileges by specifying an alternate program to execute.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kde kde 1.1
kde kde 1.1.1
kde kde 1.2
kde kde 2.0_beta

source: wwwsecurityfocuscom/bid/1206/info Some linux distributions (SuSE 64 reported) ship with kscd (a CD player for the KDE Desktop) sgid disk kscd uses the contents of the 'SHELL' environment variable to execute a browser This makes it possible to obtain a sgid 'disk' shell Using these privileges along with code provided in the ...

NVD-CWE-Other http://archives.neohapsis.com/archives/bugtraq/2000-05/0172.html http://www.novell.com/linux/security/advisories/suse_security_announce_50.html http://www.securityfocus.com/bid/1206 https://nvd.nist.gov https://www.exploit-db.com/exploits/19915/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2000-0393

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect