Mandrake Linux Security Advisory : man (MDKSA-2000:015)

This script is Copyright (C) 2012-2013 Tenable Network Security, Inc.


Synopsis :

The remote Mandrake Linux host is missing a security update.

Description :

Internet Security Systems (ISS) X-Force has identified a vulnerability
in the makewhatis Bourne shell script that ships with many Linux
distributions. It is found in versions 1.5e and higher of man, and
handles temporary files insecurely. Local users may gain a variety of
privileges depending on the complexity of the exploit. The mode of any
file on the system can be changed to 0700. Any file on the system may
be created or overwritten as root. Local users may also be able to
read any system file by forcing a copy of it into the whatis database.

Solution :

Update the affected man package.

Risk factor :

High / CVSS Base Score : 7.2
(CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)

Family: Mandriva Local Security Checks

Nessus Plugin ID: 61813 ()

Bugtraq ID:

CVE ID: CVE-2000-0566

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now