CVE-2004-0564: Low severity Roaring Penguin pppoe vulnerability
Roaring Penguin pppoe (rp-ppoe), if installed or configured to run setuid root contrary to its design, allows local users to overwrite arbitrary files. NOTE: the developer has publicly disputed the claim that this is a vulnerability because pppoe "is NOT designed to run setuid-root." Therefore this identifier applies only to those configurations and installations under which pppoe is run setuid root despite the developer's warnings.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0564?
CVE-2004-0564 is considered to have a moderate severity as it allows local users to overwrite arbitrary files when pppoe is improperly set to run with setuid root.
How do I fix CVE-2004-0564?
To fix CVE-2004-0564, ensure that the Roaring Penguin pppoe is not configured to run with setuid root permissions.
Which versions of Roaring Penguin pppoe are affected by CVE-2004-0564?
CVE-2004-0564 affects Roaring Penguin pppoe versions 3.0, 3.3, and 3.5.
Can local users exploit CVE-2004-0564?
Yes, local users can exploit CVE-2004-0564 if the pppoe is improperly set up with setuid root, allowing them to overwrite files.
What is the main issue with CVE-2004-0564?
The main issue with CVE-2004-0564 is that it stems from a design flaw where pppoe is allowed to run with unsafe permissions contrary to its intended use.