CVE-2002-0162

LogWatch < 2.5 - Arbitrary Code Execution via Symlink Attack on Temporary Directory

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-0162. PoCs published by spybreak.

AI-analyzed exploit summary This exploit targets a race condition in LogWatch 2.1.1 by predicting the process ID and creating a malicious directory in /tmp. It then symlinks a script to modify /etc/passwd, granting a root shell.

Description

LogWatch before 2.5 allows local users to execute arbitrary code via a symlink attack on the logwatch temporary directory.

Exploits (1)

exploitdb WORKING POC VERIFIED

by spybreak · bashlocallinux

https://www.exploit-db.com/exploits/21356

View Code ZIP pw:eip

This exploit targets a race condition in LogWatch 2.1.1 by predicting the process ID and creating a malicious directory in /tmp. It then symlinks a script to modify /etc/passwd, granting a root shell.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: LogWatch 2.1.1

No auth needed

Prerequisites: Local access to the target system · LogWatch 2.1.1 installed and configured to run via cron

MITRE ATT&CK