Back to Database
Status published
High
CVE-2000-0703
suidperl (aka sperl) does not properly cleanse the escape sequence...
Vulnerability Description
suidperl (aka sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, which allows local users to gain privileges by setting the "interactive" environmental variable and calling suidperl with a filename that contains the escape sequence.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2000-0703
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.turbolinux.com/pipermail/tl-security-announce/2000-August/000017.html
- http://www.securityfocus.com/bid/1547
- http://www.redhat.com/support/errata/RHSA-2000-048.html
- http://www.calderasystems.com/support/security/advisories/CSSA-2000-026.0.txt
- http://archives.neohapsis.com/archives/bugtraq/2000-08/0086.html
- http://archives.neohapsis.com/archives/bugtraq/2000-08/0153.html
- http://archives.neohapsis.com/archives/bugtraq/2000-08/0022.html
- http://www.novell.com/linux/security/advisories/suse_security_announce_59.html
- http://archives.neohapsis.com/archives/bugtraq/2000-08/0113.html
More from larry wall
View All →CVE-2007-5116
Buffer overflow in the polymorphic opcode support in the Regular...
High
7.5
CVE-2005-4278
Untrusted search path vulnerability in Perl before 5.8.7-r1 on Gentoo...
High
7.2
CVE-2005-0448
Race condition in the rmtree function in File::Path.pm in Perl...
Low
1.2
CVE-2005-0156
Buffer overflow in the PerlIO implementation in Perl 5.8.0, when...
Low
2.1
CVE-2005-0155
The PerlIO implementation in Perl 5.8.0, when installed with setuid...
Medium
4.6
Affected Vendor
larry wall
View all reports →Affected Software
perl
Vulnerable Versions:
5.4.5, 5.5, 5.5.3, 5.6
Timeline
Official Publish:
October 13th, 2000
Last Modified:
August 8th, 2024
Added to House:
July 17th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.