CVE-2000-0231: High severity Halloween Halloween Linux vulnerability
Linux kreatecd trusts a user-supplied path that is used to find the cdrecord program, allowing local users to gain root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
kreatecdfrom your environment.Uninstall kreatecd if it is not required to remove the vulnerable component from the system.
- Configuration
Configure kreatecd to use an absolute, trusted path to the cdrecord binary or validate/sanitize any user-supplied path; do not rely on a user-provided PATH environment variable to locate cdrecord.
kreatecd cdrecord lookup path = absolute trusted path or validated user input - Compensating control
Restrict who can execute or modify kreatecd and the locations used to find cdrecord (for example, remove execute access for untrusted users, enforce restrictive filesystem permissions or sudoers rules, and limit who can change PATH or binary locations).
- Operational
If you suspect the vulnerability was exploited, audit systems for signs of local privilege escalation and rotate/replace any credentials or keys that may have been exposed; restore affected systems from known-good backups as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0231?
CVE-2000-0231 has a high severity rating due to its potential to allow local users to gain root privileges.
How do I fix CVE-2000-0231?
To fix CVE-2000-0231, ensure that the kreatecd script is modified to use a secure method to find the cdrecord program.
Which versions of Linux are affected by CVE-2000-0231?
CVE-2000-0231 affects versions of Halloween Linux 4.0 and various versions of SUSE Linux from 6.0 to 6.3.
Can CVE-2000-0231 be exploited remotely?
CVE-2000-0231 is a local privilege escalation vulnerability and cannot be exploited remotely.
What impact does CVE-2000-0231 have on system security?
CVE-2000-0231 compromises system security by allowing unauthorized users to execute commands with root privileges.