CVEvulnerability

CVE-2000-0703

7.2 HIGH Published 2000-10-20 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2000-10-20
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

suidperl (aka sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, which allows local users to gain privileges by setting the "interactive" environmental variable and calling suidperl with a filename that contains the escape sequence.

Affected configurations

• larry wall perl 5.4.5 • larry wall perl 5.5 • larry wall perl 5.5.3 • larry wall perl 5.6

Related

Referenced by CWE · observed example (2)

  • CWE-138 Improper Neutralization of Special Elements weakness
  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness

References