CVE-2001-1036: High severity GNU findutils vulnerability
Published Aug 31, 2001
·Updated
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.
Affected Software
4 affected components
GNU findutils=4.0
GNU findutils=4.1
Slackware Slackware Linux=7.1
Slackware Slackware Linux=8.0
Event History
Aug 31, 2001
CVE Published
04:00 AM
Apr 2, 2003
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1036?
CVE-2001-1036 is classified as a local privilege escalation vulnerability.
2
How do I fix CVE-2001-1036?
To fix CVE-2001-1036, update the GNU findutils to version 4.2 or later.
3
Who is affected by CVE-2001-1036?
CVE-2001-1036 affects local users of Slackware 7.1 and 8.0 using GNU findutils version 4.1 or 4.0.
4
What is the impact of CVE-2001-1036?
The impact of CVE-2001-1036 includes potential unauthorized access and modification of arbitrary process memory.
5
Is there a workaround for CVE-2001-1036?
A workaround for CVE-2001-1036 is to restrict access to the locate database or remove the vulnerable software.