CVE-2003-1033

The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning…

published March 16, 2004

CVSS
—
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.1th percentile
Published
2004-03-16T05:00Z
EPSS history
Timeline
  • 16 MAR 05:00Z
    The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning…
    cvelistv5