CVE-2001-1029

OpenSSH <FreeBSD 4.4 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2001-1029. PoCs published by Przemyslaw Frasunek.

AI-analyzed exploit summary This exploit describes a privilege escalation vulnerability in FreeBSD's login process where a malicious .login.conf entry can leak sensitive files like /etc/master.passwd. It leverages improper privilege dropping during SSH or login sessions.

Description

libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Przemyslaw Frasunek · textlocalfreebsd
https://www.exploit-db.com/exploits/21114

This exploit describes a privilege escalation vulnerability in FreeBSD's login process where a malicious .login.conf entry can leak sensitive files like /etc/master.passwd. It leverages improper privilege dropping during SSH or login sessions.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: FreeBSD with OpenSSH port (specific version not specified)
Auth required
Prerequisites: Access to a user account on the target system · Ability to modify .login.conf in the user's home directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2001-09/0173.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/6073
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/8697

Scores

EPSS 0.0137
EPSS Percentile 68.3%

Details

Status published
Products (2)
freebsd/freebsd < 4.4
openbsd/openssh 4.5
Published Sep 20, 2001
Tracked Since Feb 18, 2026