CVE-2023-40303

Katalog CVE

CVSS 7.8 · High EPSS 0,41%

Kerentanan Unchecked Return Value pada gnu inetutils. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.

Rincian

Terbit di NVD

14 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-252: Unchecked Return Value

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.html exploit · mailing list · patch · advisory vendor
• https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6 patch
• http://www.openwall.com/lists/oss-security/2023/12/30/4
• https://ftp.gnu.org/gnu/inetutils/ product
• https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html