ChangePassword Local Privilege Escalation Vulnerability

Bugtraq ID:	11963
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 15 2004 12:00AM
Updated:	Dec 15 2004 12:00AM
Credit:	Discovery is credited to Ariel Berkman.
Vulnerable:	ChangePassword ChangePassword 0.8 ChangePassword ChangePassword 0.7 ChangePassword ChangePassword 0.6 -1 ChangePassword ChangePassword 0.6 ChangePassword ChangePassword 0.5 ChangePassword ChangePassword 0.4 ChangePassword ChangePassword 0.3 ChangePassword ChangePassword 0.2 ChangePassword ChangePassword 0.1
Not Vulnerable:

ChangePassword Local Privilege Escalation Vulnerability

ChangePassword is reported prone to a local privilege escalation vulnerability. This issue can allow local attackers to gain superuser privileges on a vulnerable computer.

ChangePassword 0.8 and prior versions are believed to be affected by this issue.

ChangePassword Local Privilege Escalation Vulnerability

An exploit is not required.

ChangePassword Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ChangePassword Local Privilege Escalation Vulnerability

References:

• ChangePassword 0.8 runs setuid shell ("D. J. Bernstein" )
  
• ChangePassword Home Page (ChangePassword)