CVE-2001-0366

Published: Jun 27, 2001Modified: Apr 16, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

saposcol in SAP R/3 Web Application Server Demo before 1.5 trusts the PATH environmental variable to find and execute the expand program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse expand program.

Affected (5)

Products: Sap: Sap R 3 Web Application Server Demo, Saposcol

Sap

2 products

Sap R 3 Web Application Server Demo

Saposcol

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Sap Sap R 3 Web Application Server Demo	Up to 1.5
Sap Saposcol	Version 1.0
Sap Saposcol	Version 1.1
Sap Saposcol	Version 1.2
Sap Saposcol	Version 1.3

References (8)

ftp://ftp.sap.com/pub/linuxlab/saptools/README.saposcol (unsafe URL)

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/180498

Source: cve@mitre.org

ExploitPatchVendor Advisory

http://www.securityfocus.com/bid/2662

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/6487

Source: cve@mitre.org

ftp://ftp.sap.com/pub/linuxlab/saptools/README.saposcol (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/180498

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

http://www.securityfocus.com/bid/2662

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/6487

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.