CVEvulnerability

CVE-2014-0476

3.7 LOW Published 2014-10-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-10-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
3.7 LOW — AV:L/AC:H/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

Affected configurations

• chkrootkit chkrootkit (<= 0.49) • canonical ubuntu linux 10.04 • canonical ubuntu linux 12.04 • canonical ubuntu linux 13.10 • canonical ubuntu linux 14.04

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References