CVE-2001-1091

Published: Aug 23, 2001Modified: Apr 16, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable.

Affected (6)

Products: Netbsd: Netbsd

Netbsd

1 product

Netbsd

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Netbsd Netbsd	Version 1.4.1
Netbsd Netbsd	Version 1.4.2
Netbsd Netbsd	Version 1.4.3
Netbsd Netbsd	Version 1.4
Netbsd Netbsd	Version 1.5.1
Netbsd Netbsd	Version 1.5

References (4)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-014.txt.asc (unsafe URL)

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/7037

Source: cve@mitre.org

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-014.txt.asc (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/7037

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.