CVE-2002-0499

LowCVSS 2.1/10Last modified Jun 16, 2026

Description

The d_path function in Linux kernel 2.2.20 and earlier, and 2.4.18 and earlier, truncates long pathnames without generating an error, which could allow local users to force programs to perform inappropriate operations on the wrong directories.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0074.html
http://www.cs.helsinki.fi/linux/linux-kernel/2002-13/0054.html
http://www.iss.net/security_center/static/8634.phpVendor Advisory
http://www.securityfocus.com/archive/1/264117Vendor Advisory
http://www.securityfocus.com/bid/4367Exploit, Vendor Advisory
http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0074.html
http://www.cs.helsinki.fi/linux/linux-kernel/2002-13/0054.html
http://www.iss.net/security_center/static/8634.phpVendor Advisory
http://www.securityfocus.com/archive/1/264117Vendor Advisory
http://www.securityfocus.com/bid/4367Exploit, Vendor Advisory

Timeline

Published: Aug 12, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-05005.0Internet Explorer 5.0 through 6.0 allows remote attackers to determine the existence of files on the client via an IMG tag with a dynsrc pro CVE-2002-05017.2Format string vulnerability in log_print() function of Posadis DNS server before version m5pre2 allows local users and possibly remote attac CVE-2002-05025.0Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page.CVE-2002-05035.0Directory traversal vulnerability in boilerplate.asp for Citrix NFuse 1.5 allows remote authenticated users to read arbitrary files via a ..CVE-2002-05047.5Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote CVE-2002-05055.0Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote a CVE-2002-05067.2Buffer overflow in newt.c of newt windowing library (libnewt) 0.50.33 and earlier may allow attackers to cause a denial of service or execut CVE-2002-05072.1An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a pre CVE-2002-050810.0wwwisis 3.45 and earlier allows remote attackers to execute arbitrary commands and read files via the parameters (1) prolog or (2) epilog.CVE-2002-05095.0Transparent Network Substrate (TNS) Listener in Oracle 9i 9.0.1.1 allows remote attackers to cause a denial of service (CPU consumption) via CVE-2002-05105.0The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remot CVE-2002-05117.5The default configuration of Name Service Cache Daemon (nscd) in Caldera OpenLinux 3.1 and 3.1.1 uses cached PTR records instead of consulti