CVEvulnerability

CVE-2001-1029

2.1 LOW Published 2001-09-20 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2001-09-20
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N

Description

libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files.

Affected configurations

• openbsd openssh 4.5 • freebsd freebsd (<= 4.4)

Related

Referenced by CWE · observed example (1)

  • CWE-271 Privilege Dropping / Lowering Errors weakness

References