CVE-2000-1202

HighCVSS 7.2/10Last modified Nov 11, 2026

Description

ikeyman in IBM IBMHSSSB 1.0 sets the CLASSPATH environmental variable to include the user's own CLASSPATH directories before the system's directories, which allows a malicious local user to execute arbitrary code as root via a Trojan horse Ikeyman class.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/archive/1/54073Exploit, Vendor Advisory
http://www.securityfocus.com/bid/1092Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/4235
http://www.securityfocus.com/archive/1/54073Exploit, Vendor Advisory
http://www.securityfocus.com/bid/1092Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/4235

Timeline

Published: Aug 31, 2001
Last modified: Nov 11, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-12035.0Lotus Domino SMTP server 4.63 through 5.08 allows remote attackers to cause a denial of service (CPU consumption) by forging an email messag CVE-2000-12045.0Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source CVE-2000-12054.3Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via CVE-2000-12065.0Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9,CVE-2000-12077.2userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in g CVE-2000-12087.2Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges CVE-2000-120910.0The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) CVE-2000-12105.0Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot do CVE-2000-12117.5Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects CVE-2000-12125.0Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editin CVE-2000-12137.5ping in iputils before 20001010, as distributed on Red Hat Linux 6.2 through 7J and other operating systems, does not drop privileges after CVE-2000-12144.6Buffer overflows in the (1) outpack or (2) buf variables of ping in iputils before 20001010, as distributed on Red Hat Linux 6.2 through 7J