CVE-2003-0489 : tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a f

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute.

Published 2003-08-07 04:00:00

Updated 2008-09-05 20:34:27

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2003-0489

Michael C. Toren » Tcptraceroute
Versions up to, including, (<=) 1.4
cpe:2.3:a:michael_c._toren:tcptraceroute:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2003-0489

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2003-0489

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2003-0489

http://www.debian.org/security/2003/dsa-330

Debian -- The Universal Operating System
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2003-0489

Products affected by CVE-2003-0489

Exploit prediction scoring system (EPSS) score for CVE-2003-0489

CVSS scores for CVE-2003-0489

References for CVE-2003-0489