Servers and applications
CVE-2001-1029
libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files.
- Severity
- Low 2.1
- Published
- 20 Sept 2001
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Exploit chance
- 1.4% in the next 30 daysHigher than 72% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Needs local access · No login needed
- Attacker can
- Read some data
- CVSS vector
AV:L/AC:L/Au:N/C:P/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
OpenSSHServers and applications · cpe:a:openbsd:openssh |
|