{"id":"CVE-2017-14609","aliases":["EUVD-2017-6110","GHSA-m8xx-gwj7-2r5j","UBUNTU-CVE-2017-14609"],"status":"published","title":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a...","description":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by bearerbox.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00407,"percentile":0.35275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-665"],"published":"2017-09-20T18:00:00Z","modified":"2026-10-17T12:53:12Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.4-1","1.4.4-2","1.4.4-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.4-4","1.4.4-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5-3ubuntu1","1.4.5-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5-9ubuntu1","1.4.5-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5-9ubuntu2","1.4.5-13ubuntu1","1.4.5-13ubuntu2","1.4.5-13ubuntu3","1.4.5-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5-20ubuntu2","1.4.5-20ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5-20ubuntu3","1.4.5-23ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.5-20ubuntu3"]}],"products":[{"vendor":"kannel","product":"kannel"}],"references":[{"url":"https://redmine.kannel.org/issues/771","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14609"},{"url":"https://github.com/advisories/GHSA-m8xx-gwj7-2r5j"},{"url":"https://ubuntu.com/security/CVE-2017-14609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14609","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-14609","description":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by bearerbox.","status":"published","published":"2017-09-20T18:00:00Z","modified":"2024-09-17T00:16:42.556Z","updated_at":"2026-11-02T14:33:11.928814Z"}],"euvd":[{"id":"EUVD-2017-6110","description":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by bearerbox.","status":"published","published":"2017-09-20T18:00:00Z","modified":"2024-09-17T00:16:42Z","updated_at":"2026-11-03T00:29:00.656249Z"}],"ghsa":[{"id":"GHSA-m8xx-gwj7-2r5j","title":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a...","description":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by bearerbox.","status":"published","published":"2022-05-13T01:43:27Z","modified":"2023-02-02T05:00:56Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:51:04.373532Z"}],"nvd":[{"id":"CVE-2017-14609","description":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by bearerbox.","status":"published","published":"2017-09-20T18:29:01.563Z","modified":"2026-06-17T01:06:28.677Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:03:59.716532Z"}],"osv":[{"id":"UBUNTU-CVE-2017-14609","description":"The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by bearerbox.","status":"published","published":"2017-09-20T18:29:00Z","modified":"2026-10-17T12:53:12.202352468Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"}]}}