CVE-2002-2334

Published: Dec 31, 2002Modified: Apr 16, 2026

3.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 3.9 / Impact: 4.9

Source: NVD

Description

Joe text editor 2.8 through 2.9.7 does not remove the group and user setuid bits for backup files, which could allow local users to execute arbitrary setuid and setgid root programs when root edits scripts owned by other users.

Affected (8)

Products: Joseph Allen: Joe

Joseph Allen

1 product

Joe

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Joseph Allen Joe	Version 2.8
Joseph Allen Joe	Version 2.9.1
Joseph Allen Joe	Version 2.9.2
Joseph Allen Joe	Version 2.9.4
Joseph Allen Joe	Version 2.9.5
Joseph Allen Joe	Version 2.9.6
Joseph Allen Joe	Version 2.9.7
Joseph Allen Joe	Version 2.9

Related CWEs

CWE-264

References (6)

http://online.securityfocus.com/archive/1/292138

Source: cve@mitre.org

http://www.iss.net/security_center/static/10125.php

Source: cve@mitre.org

http://www.securityfocus.com/bid/5732

Source: cve@mitre.org

http://online.securityfocus.com/archive/1/292138

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.iss.net/security_center/static/10125.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/5732

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.