BID:7006

uschedule Local Privilege Escalation Vulnerability

Info

uschedule Local Privilege Escalation Vulnerability

Bugtraq ID:	7006
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 04 2003 12:00AM
Updated:	Mar 04 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Zas <[email protected]>.
Vulnerable:	uschedule uschedule 0.6.1 uschedule uschedule 0.6 .0 uschedule uschedule 0.5.8 uschedule uschedule 0.5.7 uschedule uschedule 0.5.6 uschedule uschedule 0.5.5 uschedule uschedule 0.5.4 uschedule uschedule 0.5.3

Not Vulnerable:	uschedule uschedule 0.7 .0

Discussion

uschedule Local Privilege Escalation Vulnerability

A privilege escalation vulnerability has been reported for uschedule. The vulnerability exists in the uscheduleconf utility included with uschedule.

Due to errors in the code, uschedule may leave multilog running as the root user rather than the non-privileged user when executed with certain commandline arguments. This may result in the malicious local attacker obtaining root privileges to a system.

Exploit / POC

uschedule Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.