Improper privilege management in Linux kernel - CVE-2000-0506
Published: June 9, 2000 / Updated: November 6, 2024
Vulnerability identifier: #VU99991
CSH Severity: Low
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2000-0506
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The 'capabilities' feature in Linux before 2.2.16 allows local users to cause a denial of service or gain privileges by setting the capabilities to prevent a setuid program from dropping privileges, aka the 'Linux kernel setuid/setcap vulnerability.'
Affected software
Linux kernel
How to mitigate CVE-2000-0506
Install update from vendor's repository.
Links to Public Exploits and PoC-codes
External References
- ftp://sgigate.sgi.com/security/20000802-01-P
- http://archives.neohapsis.com/archives/bugtraq/2000-06/0062.html
- http://archives.neohapsis.com/archives/bugtraq/2000-06/0063.html
- http://www.redhat.com/support/errata/RHSA-2000-037.html
- http://www.securityfocus.com/bid/1322
- http://www.securityfocus.com/templates/archive.pike?list=1&msg=Pine.LNX.4.21.0006090852340.3475-300000@alfa.elzabsoft.pl