CVE-2000-0172: High severity Matt Kimball And Roger Wolff Mtr vulnerability
The mtr program only uses a seteuid call when attempting to drop privileges, which could allow local users to gain root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
mtrfrom your environment.Uninstall the mtr package/binary from systems where it is not required to eliminate the attack surface.
- Configuration
Remove the setuid bit from the mtr binary so it cannot run with elevated privileges (for example: chmod u-s /path/to/mtr). Ensure file ownership and permissions restrict execution to appropriate users.
mtr (binary) setuid = disabled - Compensating control
Restrict execution of the mtr binary to trusted users or groups (for example via file permissions, sudoers rules, or local access controls). Audit systems for instances of mtr and restrict or remove access where possible until a code fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0172?
The severity of CVE-2000-0172 is considered high due to the potential for local users to gain root privileges.
How do I fix CVE-2000-0172?
To fix CVE-2000-0172, update to a version of the mtr program that is not affected, specifically versions later than 0.41.
Which versions of mtr are affected by CVE-2000-0172?
CVE-2000-0172 affects mtr versions 0.28 and 0.41, along with specific versions of Turbolinux.
Can CVE-2000-0172 be exploited remotely?
CVE-2000-0172 is a local vulnerability and cannot be exploited remotely.
Who can be affected by CVE-2000-0172?
Local users on systems running the vulnerable versions of mtr can be affected by CVE-2000-0172.