CVE-2001-1017 json
rmuser utility in FreeBSD 4.2 and 4.3 creates a copy of the master.passwd file with world-readable permissions while updating the original…
published 2001-09-04 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-0998
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
rmuser utility in FreeBSD 4.2 and 4.3 creates a copy of the master.passwd file with world-readable permissions while updating the original file, which could allow local users to gain privileges by reading the copied file while rmuser is running, obtain the password hashes, and crack the passwords.
Patch / fix
- securityfocus.com/bid/3282 advisory
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/bid/3282
vdb-entry, patch, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/7086
vdb-entry
-
osvdb.org
/1947
vdb-entry
Sources
- CVE List CVE-2001-1017
- NVD CVE-2001-1017
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.