Vulnerabilities > CVE-2004-1263 - Denial-Of-Service vulnerability in ChangePassword

CVSS 7.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

low complexity

changepassword

NVD

Published: 2005-01-10

Updated: 2017-07-11

Summary

changepassword.cgi in ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious "make" program.

Vulnerable Configurations

Part	Description	Count
Application	Changepassword Changepassword Changepassword 0.1 Changepassword Changepassword 0.2 Changepassword Changepassword 0.3 Changepassword Changepassword 0.4 Changepassword Changepassword 0.5 Changepassword Changepassword 0.6 Changepassword Changepassword 0.6.1 Changepassword Changepassword 0.7 Changepassword Changepassword 0.8	9

References

http://tigger.uic.edu/~jlongs2/holes/changepassword.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/18593