{"id":"CVE-2014-0476","aliases":["DEBIAN-CVE-2014-0476","DLA-0002-1","DSA-2945-1","EUVD-2014-0511","GHSA-f6jc-6vm7-jv5m","MGASA-2014-0249","UBUNTU-CVE-2014-0476","USN-2230-1"],"status":"published","title":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows...","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","severity":{"version":"2.0","score":3.7,"vector":"AV:L/AC:H/Au:N/C:P/I:P/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03832,"percentile":0.90171,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2014-06-03T00:00:00Z","modified":"2026-10-23T15:47:30Z","exploits":[{"source":"exploitdb","id":"EDB-33899","title":"Chkrootkit 0.49 - Local Privilege Escalation","type":"local","platform":"linux","date":"2014-06-28","verified":true,"url":"https://www.exploit-db.com/exploits/33899"},{"source":"exploitdb","id":"EDB-38775","title":"Chkrootkit - Local Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2015-11-20","verified":true,"url":"https://www.exploit-db.com/exploits/38775"},{"source":"metasploit","id":"exploit/unix/local/chkrootkit","title":"Chkrootkit Local Privilege Escalation","type":"exploit","platform":"Unix","date":"2014-06-04","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/local/chkrootkit"}],"fixes":[{"ecosystem":"Debian:12","package":"chkrootkit","fixed_in":["0.49-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"chkrootkit","fixed_in":["0.49-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"chkrootkit","fixed_in":["0.49-5"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"chkrootkit","fixed_in":["0.49-4+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"chkrootkit","fixed_in":["0.49-4.1+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"chkrootkit","fixed_in":["0.49-6.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"chkrootkit","fixed_in":["0.49-8.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"chkrootkit","fixed_in":["0.49-4.1ubuntu1.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-5"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-4+deb6u1"}]}],"versions":["0.49-4"]},{"source":"osv","ecosystem":"Debian:7","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-4.1+deb7u2"}]}],"versions":["0.49-4.1","0.49-4.1+deb7u1"]},{"source":"osv","ecosystem":"Mageia:3","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-6.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-8.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-4.1ubuntu1.14.04.1"}]}],"versions":["0.49-4.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"chkrootkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-4.1ubuntu1.14.04.1"}]}],"versions":["0.49-4.1ubuntu1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"chkrootkit","product":"chkrootkit"}],"references":[{"url":"http://www.chkrootkit.org/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/06/04/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence"]},{"url":"https://security.gentoo.org/glsa/201709-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2230-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://osvdb.org/show/osvdb/107710","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-2945","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://packetstormsecurity.com/files/134484/Chkrootkit-Local-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/38775/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0476"},{"url":"https://www.exploit-db.com/exploits/38775"},{"url":"http://www.chkrootkit.org"},{"url":"https://github.com/advisories/GHSA-f6jc-6vm7-jv5m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0476","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0249.html","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/06/04/9","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=6699","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0476","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2230-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0476","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0476","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","status":"published","published":"2014-10-25T22:00:00Z","modified":"2024-08-06T09:20:17.97Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0511","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","status":"published","published":"2014-10-25T22:00:00Z","modified":"2024-08-06T09:20:17Z","updated_at":"2026-11-03T01:57:21.099925Z"}],"ghsa":[{"id":"GHSA-f6jc-6vm7-jv5m","title":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows...","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","status":"published","published":"2022-05-17T00:53:10Z","modified":"2025-04-12T12:42:16Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:19.407948Z"}],"nvd":[{"id":"CVE-2014-0476","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","status":"published","published":"2014-10-25T22:55:04.07Z","modified":"2026-06-17T00:03:06.85Z","cvss":[{"version":"2.0","score":3.7,"vector":"AV:L/AC:H/Au:N/C:P/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:56.921017Z"}],"osv":[{"id":"CVE-2014-0476","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","status":"published","published":"2014-10-25T22:55:04Z","modified":"2026-04-16T06:22:37.037355945Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0476","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","status":"published","published":"2014-10-25T22:55:04.07Z","modified":"2026-10-23T15:47:30.324964932Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-0002-1","title":"chkrootkit - security update","status":"published","published":"2014-06-04T00:00:00Z","modified":"2026-03-09T01:01:01.300528Z","updated_at":"2026-11-02T15:46:08.746073Z"},{"id":"DSA-2945-1","title":"chkrootkit - security update","status":"published","published":"2014-06-03T00:00:00Z","modified":"2026-03-09T01:18:59.315118Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0249","title":"Updated chkrootkit packages fix CVE-2014-0476 and a false positive","description":"Updated chkrootkit package fixes security vulnerability:\n\nThe chkrootkit script contains a flaw that allows a local attacker to create\nan executable in /tmp that will be run by the user running chkrootkit (usually\nroot), allowing the attacker to escalate privileges (CVE-2014-0476).\n\nThe Mageia 3 update also eliminates the false positive identification of a\nrootkit in /sbin/init (mga#6699).\n","status":"published","published":"2014-06-04T20:44:17Z","modified":"2026-04-16T06:23:18.733865459Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-0476","description":"The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.","status":"published","published":"2014-06-04T00:00:00Z","modified":"2026-02-04T02:15:45.059732Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2230-1","title":"chkrootkit vulnerability","description":"Thomas Stangner discovered that chkrootkit incorrectly quoted certain\nvalues. A local attacker could use this issue to execute arbitrary code\nwhen chkrootkit is run and gain root privileges.\n","status":"published","published":"2014-06-04T13:58:22Z","modified":"2026-02-10T04:40:49Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}