CVEvulnerability
CVE-2002-1576
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2004-04-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
Description
lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program.
Affected configurations
• sap sap db 7.3.00
Related
Referenced by CWE · observed example (1)
- CWE-427 Uncontrolled Search Path Element weakness
References
- http://marc.info/?l=bugtraq&m=103903565829796&w=2 marc.info
- http://www.sapdb.org/sap_db_alert.htm Patch
- http://www.securityfocus.com/bid/6316 Exploit, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10762 exchange.xforce.ibmcloud.com
- http://marc.info/?l=bugtraq&m=103903565829796&w=2 marc.info
- http://www.sapdb.org/sap_db_alert.htm Patch
- http://www.securityfocus.com/bid/6316 Exploit, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10762 exchange.xforce.ibmcloud.com