Unscored CVE-2001-0943 EUVD-2001-0926GHSA-7rq4-mcf2-wqcx

dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) c…

Published Feb 2, 2002 · Updated Aug 8, 2024 · Assigned by mitre

Description

dbsnmp in Oracle 8.0.5 and 8.1.5, under certain conditions, trusts the PATH environment variable to find and execute the (1) chown or (2) chgrp commands, which allows local users to execute arbitrary code by modifying the PATH to point to Trojan Horse programs.

References

http://otn.oracle.com/deploy/security/pdf/dbsmp_alert.pdf
3129 vdb-entry
20011130 ASI Oracle Security Alert: CHOWN Path Environment Variable Vulnerability mailing-list
20010801 Oracle 8.1.5 dbnsmp vulnerability mailing-list