CVE-2004-0233

Utempter allows device names that contain .. (dot dot) directory traversal sequences, which...

2.1 LowPublic exploitFix available

Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.

Exploit likelihood

1.09%Down 2.1 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

Record: CVE-2004-0233
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-0233
Updated: 2026-11-02

EUVDEUVD-2004-0233 No score

Record: EUVD-2004-0233
Updated: 2026-11-03

GitHub AdvisoriesGHSA-67cc-jx4w-3hpw No score

Utempter allows device names that contain .. (dot dot) directory traversal sequences, which...

Record: GHSA-67cc-jx4w-3hpw
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`utempter` Red Hat:enterprise_linux:3::as	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0
`utempter-debuginfo` Red Hat:enterprise_linux:3::as	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0
`utempter` Red Hat:enterprise_linux:3::desktop	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0
`utempter-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0
`utempter` Red Hat:enterprise_linux:3::es	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0
`utempter-debuginfo` Red Hat:enterprise_linux:3::es	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0
`utempter` Red Hat:enterprise_linux:3::ws	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0
`utempter-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:0.5.5-1.3EL.0	0:0.5.5-1.3EL.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	UTempter 0.5.x - Multiple Local Vulnerabilities	2004-04-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0233 is a low vulnerability (CVSS 2.1) in Utempter, published May 5, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in utempter 0:0.5.5-1.3EL.0.

References

Show 13 moreShow less