A vulnerability, which was classified as critical, was found in XFree86 X11r6 3.3.2. Affected is an unknown code block of the component xman. The manipulation of the argument MANPATH as part of a Environment Variable leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

xman allows local users to gain privileges by modifying the MANPATH to point to a man page whose filename contains shell metacharacters.

The weakness was disclosed 07/17/2001 as not defined posting (Bugtraq). The advisory is available at securityfocus.com. This vulnerability is traded as CVE-2001-1179. The exploitability is told to be easy. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

Productinfo

Vendor

• XFree86

Name

• X11r6

Version

• 3.3.2

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion