CVE-2001-1029 json
libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welc…
published 2001-09-20 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-1010
- cvss
- 2.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 1
- Exploit-DB
Summary
libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files.
Timeline
- First public exploit (EDB-21114)
- Published
Exploit prediction
1.37% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-21114 FreeBSD 4.3/4.4 - Login Capabilities Privileged File Reading local, 2001-09-17
- archives.neohapsis.com http://archives.neohapsis.com/archives/bugtraq/2001-09/0173.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
References
-
archives.neohapsis.com
/archives/bugtraq/2001-09/0173.html
mailing-list, exploit
-
osvdb.org
/6073
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/8697
vdb-entry
Sources
- CVE List CVE-2001-1029
- NVD CVE-2001-1029
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.