CVEvulnerability

CVE-2002-0080

2.1 LOW Published 2002-03-15 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2002-03-15
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses: CWE-269

Description

rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.

Affected configurations

• samba rsync (< 2.5.3) • redhat linux 6.2 • redhat linux 7.0 • redhat linux 7.1 • redhat linux 7.2

Weakness · CWE (1)

CWE-269 Improper Privilege Management weakness

Referenced by CWE · observed example (2)

CWE-271 Privilege Dropping / Lowering Errors weakness
CWE-842 Placement of User into Incorrect Group weakness

References

http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt Broken Link
http://www.iss.net/security_center/static/8463.php Broken Link
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-024.php3 Broken Link
http://www.redhat.com/support/errata/RHSA-2002-026.html Patch, Third Party Advisory
http://www.securityfocus.com/bid/4285 Third Party Advisory, VDB Entry
http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt Broken Link
http://www.iss.net/security_center/static/8463.php Broken Link
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-024.php3 Broken Link
http://www.redhat.com/support/errata/RHSA-2002-026.html Patch, Third Party Advisory
http://www.securityfocus.com/bid/4285 Third Party Advisory, VDB Entry