CVE-2002-0225

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

tac_plus Tacacs+ daemon F4.0.4.alpha, originally maintained by Cisco, creates files from the accounting directive with world-readable and writable permissions, which allows local users to access and modify sensitive files.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://online.securityfocus.com/archive/1/253288Vendor Advisory
http://www.iss.net/security_center/static/8061.phpVendor Advisory
http://www.securityfocus.com/bid/4003Vendor Advisory
http://online.securityfocus.com/archive/1/253288Vendor Advisory
http://www.iss.net/security_center/static/8061.phpVendor Advisory
http://www.securityfocus.com/bid/4003Vendor Advisory

Timeline

Published: May 16, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-02267.5retrieve_password.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to requ CVE-2002-02275.0KICQ 2.0.0b1 allows remote attackers to cause a denial of service (crash) via a malformed message.CVE-2002-02285.0Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as CVE-2002-02297.5Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restric CVE-2002-02305.0Cross-site scripting vulnerability in fom.cgi of Faq-O-Matic 2.712 allows remote attackers to execute arbitrary Javascript on other clients CVE-2002-02317.5Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname.CVE-2002-02325.0Directory traversal vulnerability in Multi Router Traffic Grapher (MRTG) allows remote attackers to read portions of arbitrary files via a .CVE-2002-02335.0Directory traversal vulnerability in eshare Expressions 4 Web server allows remote attackers to read arbitrary files via a .. (dot dot) in a CVE-2002-02342.1NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system, which allows an attacker on the trust CVE-2002-02357.5Castelle FaxPress, possibly 6.3 and other versions, when configured to use the Network print queue, allows attackers to obtain the username CVE-2002-02367.5Lucent VitalSuite 8.0 through 8.2, including VitalNet, VitalEvent, and VitalHelp/VitalAnalysis, allows remote attackers to bypass authentica CVE-2002-02377.5Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remot