CVE-2002-0333

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to read files with short names, and local users to read more files using a symlink with a short name, via a .. in the TTY argument.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=101494896516467&w=2
http://www.debian.org/security/2002/dsa-121Patch, Vendor Advisory
http://www.iss.net/security_center/static/8313.phpExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/4194Exploit, Patch, Vendor Advisory
http://marc.info/?l=bugtraq&m=101494896516467&w=2
http://www.debian.org/security/2002/dsa-121Patch, Vendor Advisory
http://www.iss.net/security_center/static/8313.phpExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/4194Exploit, Patch, Vendor Advisory

Timeline

Published: Jun 25, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-03342.1xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows local users to modify files via a symlink attack on the .xtell-log file.CVE-2002-033510.0Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly exe CVE-2002-03367.5Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly exe CVE-2002-03375.4RealPlayer 8 allows remote attackers to cause a denial of service (CPU utilization) via malformed .mp3 files.CVE-2002-03385.0The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service (crash) via an attachment who CVE-2002-03395.0Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC leve CVE-2002-03407.5Windows Media Player (WMP) 8.00.00.4477, and possibly other versions, automatically detects and executes .wmf and other content, even when t CVE-2002-03415.0GWWEB.EXE in GroupWise Web Access 5.5, and possibly other versions, allows remote attackers to determine the full pathname of the web server CVE-2002-03425.0Kmail 1.2 on KDE 2.1.1 allows remote attackers to cause a denial of service (crash) via an email message whose body is approximately 55 K lo CVE-2002-03434.6Hotline Client 1.8.5 stores sensitive user information, including passwords, in plaintext in the bookmarks file, which could allow local use CVE-2002-03445.0Symantec LiveUpdate 1.5 and earlier in Norton Antivirus stores usernames and passwords for a local LiveUpdate server in cleartext in the reg CVE-2002-03457.5Symantec Ghost 7.0 stores usernames and passwords in plaintext in the NGServer\params registry key, which could allow an attacker to gain pr