CVE
- Id
- 7857
- CVE No.
- CVE-2003-1033
- Status
- Candidate
- Description
- The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.
- Phase
- Assigned (20040315)
- Votes
- None (candidate not yet proposed)
- Comments