CVE-2002-0080

Published: Mar 15, 2002Modified: Apr 16, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.

Affected (5)

Products: Samba: Rsync · Redhat: Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Samba Rsync	Before 2.5.3

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Linux	Version 6.2
Redhat Linux	Version 7.0
Redhat Linux	Version 7.1
Redhat Linux	Version 7.2

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (10)

http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt

Source: cve@mitre.org

Broken Link

http://www.iss.net/security_center/static/8463.php

Source: cve@mitre.org

Broken Link

http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-024.php3

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2002-026.html

Source: cve@mitre.org

PatchThird Party Advisory

http://www.securityfocus.com/bid/4285

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt