CVE-2002-0638: Race Condition
setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2002-0638?
CVE-2002-0638 is considered to have a low to medium severity due to its exploitation requiring a complex race condition.
How do I fix CVE-2002-0638?
To fix CVE-2002-0638, ensure you apply the appropriate patches or updates as provided by your operating system vendor.
Which operating systems are affected by CVE-2002-0638?
CVE-2002-0638 affects various versions of Red Hat Linux, Mandrake Linux, and HP Secure OS.
Can local users exploit CVE-2002-0638?
Yes, local users may exploit CVE-2002-0638 through a race condition when modifying /etc/passwd.
Is CVE-2002-0638 a critical vulnerability?
No, CVE-2002-0638 is not classified as critical but can lead to privilege escalation under certain conditions.