← Back

CVE-2014-0476

nvd nist
Published: Oct 25, 2014Modified: May 6, 2026

JSON object

Loading...
3.7
Vector
AV:L/AC:H/Au:N/C:P/I:P/A:P
Exploitability: 1.9 / Impact: 6.4
Source: NVD

Description

The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

Affected (5)

Canonical
1 product
Ubuntu Linux
Chkrootkit
1 product
Chkrootkit
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 10.04
Ubuntu Linux
Version 12.04
Ubuntu Linux
Version 13.10
Ubuntu Linux
Version 14.04
Chkrootkit
Up to 0.49

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

Source: security@debian.org
Source: security@debian.org
Source: security@debian.org
Vendor Advisory
Source: security@debian.org
Source: security@debian.org
Exploit
Source: security@debian.org
Source: security@debian.org
Source: security@debian.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.