CVE-2001-1324
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return...
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
Exploit likelihood
What each source reports
NVD Score used
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
- Record
CVE-2001-1324- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
- Record
CVE-2001-1324- Updated
- 2026-11-02
EUVDEUVD-2001-1305 No score
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
- Record
EUVD-2001-1305- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvr4-2p3v-j73r No score
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return...
cvmlogin and statfile in Paul Jarc idtools before 2001.06.27 do not properly check the return value of a call to the pathexec_env function, which could cause the setstate utility to setuid to the UID environment variable and allow local users to gain privileges.
- Record
GHSA-hvr4-2p3v-j73r- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2001-1324 is a medium vulnerability (CVSS 4.6) in Paul Jarc Idtools, published June 26, 2001. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. No source names a fixed version.