CVE-2014-0476
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows...
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
Exploit likelihood
What each source reports
NVD Score used
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
- Record
CVE-2014-0476- CVSS 2.0
- 3.7 Low
AV:L/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
- Record
CVE-2014-0476- Updated
- 2026-11-02
EUVDEUVD-2014-0511 No score
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
- Record
EUVD-2014-0511- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f6jc-6vm7-jv5m No score
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows...
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
- Record
GHSA-f6jc-6vm7-jv5m- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
- Record
CVE-2014-0476- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0476 No score
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
- Record
DEBIAN-CVE-2014-0476- Updated
- 2026-11-02
OSVMGASA-2014-0249 No score
Updated chkrootkit packages fix CVE-2014-0476 and a false positive
Updated chkrootkit package fixes security vulnerability:
The chkrootkit script contains a flaw that allows a local attacker to create an executable in /tmp that will be run by the user running chkrootkit (usually root), allowing the attacker to escalate privileges (CVE-2014-0476).
The Mageia 3 update also eliminates the false positive identification of a rootkit in /sbin/init (mga#6699).
- Record
MGASA-2014-0249- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0476 No score
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
- Record
UBUNTU-CVE-2014-0476- Updated
- 2026-11-02
OSVUSN-2230-1 No score
chkrootkit vulnerability
Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use this issue to execute arbitrary code when chkrootkit is run and gain root privileges.
- Record
USN-2230-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chkrootkitDebian:12 |
before 0.49-5 | 0.49-5 |
chkrootkitDebian:13 |
before 0.49-5 | 0.49-5 |
chkrootkitDebian:14 |
before 0.49-5 | 0.49-5 |
chkrootkitDebian:6.0 |
before 0.49-4+deb6u1, plus listed versions 0.49-4 |
0.49-4+deb6u1 |
chkrootkitDebian:7 |
before 0.49-4.1+deb7u2, plus listed versions 0.49-4.10.49-4.1+deb7u1 |
0.49-4.1+deb7u2 |
chkrootkitMageia:3 |
before 0.49-6.1.mga3 | 0.49-6.1.mga3 |
chkrootkitMageia:4 |
before 0.49-8.1.mga4 | 0.49-8.1.mga4 |
chkrootkitUbuntu:14.04:LTS |
before 0.49-4.1ubuntu1.14.04.1, plus listed versions 0.49-4.1ubuntu1 |
0.49-4.1ubuntu1.14.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Chkrootkit 0.49 - Local Privilege Escalation | 2014-06-28 |
| Exploit-DB | Chkrootkit - Local Privilege Escalation (Metasploit) | 2015-11-20 |
| Metasploit | Chkrootkit Local Privilege Escalation | 2014-06-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0476 is a low vulnerability (CVSS 3.7) in Chkrootkit, published June 3, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.83%, the 90th percentile. Fixed in chkrootkit 0.49-5.
References
chkrootkit.org
openwall.com/lists/oss-security/2014/06/04/9
security.gentoo.org/glsa/201709-05
ubuntu.com/usn/USN-2230-1
osvdb.org/show/osvdb/107710
debian.org/security/2014/dsa-2945
Show 11 moreShow less
packetstormsecurity.com/files/134484/Chkrootkit-Local-Privilege-Escalation.html
exploit-db.com/exploits/38775
nvd.nist.gov/vuln/detail/CVE-2014-0476
github.com/advisories/GHSA-f6jc-6vm7-jv5m
security-tracker.debian.org/tracker/CVE-2014-0476
advisories.mageia.org/MGASA-2014-0249.html
bugs.mageia.org/show_bug.cgi?id=6699
ubuntu.com/security/CVE-2014-0476
cve.org/CVERecord?id=CVE-2014-0476