CVE-2001-1374: High severity Don Libes Expect vulnerability
Published Jul 19, 2001
·Updated
expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse library that is accessed by mkpasswd.
Affected Software
40 affected components
Don Libes Expect=0
Don Libes Expect=1
Don Libes Expect=2
Don Libes Expect=3
Don Libes Expect=4
Don Libes Expect=5.0
Don Libes Expect=5.1
Don Libes Expect=5.2
Don Libes Expect=5.3
Don Libes Expect=5.4
Don Libes Expect=5.5
Don Libes Expect=5.6
Don Libes Expect=5.7
Don Libes Expect=5.8
Don Libes Expect=5.9
Don Libes Expect=5.10
Don Libes Expect=5.11
Don Libes Expect=5.12
Don Libes Expect=5.13
Don Libes Expect=5.14
Don Libes Expect=5.15
Don Libes Expect=5.16
Don Libes Expect=5.17
Don Libes Expect=5.18
Don Libes Expect=5.19
Don Libes Expect=5.20
Don Libes Expect=5.21
Don Libes Expect=5.22
Don Libes Expect=5.23
Don Libes Expect=5.24
Don Libes Expect=5.25
Don Libes Expect=5.26
Don Libes Expect=5.27
Don Libes Expect=5.28
Don Libes Expect=5.29
Don Libes Expect=5.30
Don Libes Expect=5.31
Conectiva Linux=6.0
Conectiva Linux=7.0
redhat Linux=7.0
Remediation
Patch Available
Event History
Jul 19, 2001
CVE Published
04:00 AM
Apr 2, 2003
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1374?
CVE-2001-1374 is considered a critical vulnerability as it could allow local users to gain root privileges.
2
How do I fix CVE-2001-1374?
To fix CVE-2001-1374, upgrade Expect to a version later than 5.32 where the vulnerability has been addressed.
3
Which versions of Expect are affected by CVE-2001-1374?
CVE-2001-1374 affects Expect versions up to and including 5.31.
4
What is the impact of CVE-2001-1374 on a system?
The impact of CVE-2001-1374 allows local users to execute arbitrary code with elevated privileges.
5
Is there a workaround for CVE-2001-1374 if I cannot upgrade Expect?
A possible workaround for CVE-2001-1374 is to restrict access to the /var/tmp directory or audit library loading paths.