CVE-2000-1125 json
restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users t…
published 2000-12-19 25 y ago modified 2026-06-16 4 mo ago also EUVD-2000-1110
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 3
- Exploit-DB
Summary
restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program.
Timeline
- First public exploit (EDB-20385)
- Published
Exploit prediction
1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-20385 RedHat 0.4 b15 restore - Insecure Environment Variables local, 2000-11-04
- EDB-184 RedHat 6.2 Restore and Dump - Local Privilege Escalation local, 2000-11-16
- EDB-182 RedHat 6.2 - '/sbin/restore' Local Privilege Escalation local, 2000-11-16
- securityfocus.com http://www.securityfocus.com/bid/1914 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/bid/1914
vdb-entry, exploit, vendor-advisory
-
marc.info
/?l=bugtraq&m=97336034309944&w=2
mailing-list
Sources
- CVE List CVE-2000-1125
- NVD CVE-2000-1125
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.