CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Permissions Privileges and Access Controls
Summary: the replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0.65-2 in red hat enterprise linux (rhel) 5 uses lstat instead of stat to determine the /etc/pam.d/system-auth file permissions, leading to a change to world-writable permissions for the /etc/pam.d/system-auth-ac file, which allows local users to gain privileges by modifying this file.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2008-04-04
Last Modified Date: 2017-08-08
You are a cybersecurity expert assistant. Provide detailed information about vulnerabilities in a clear and structured format.
system
Please provide details about this vulnerability:  Permissions Privileges and Access Controls.
user
CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Permissions Privileges and Access Controls
Summary: the replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0.65-2 in red hat enterprise linux (rhel) 5 uses lstat instead of stat to determine the /etc/pam.d/system-auth file permissions, leading to a change to world-writable permissions for the /etc/pam.d/system-auth-ac file, which allows local users to gain privileges by modifying this file.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2008-04-04
Last Modified Date: 2017-08-08
assistant