VULNERABILITY INTELLIGENCE

CVE-2002-1160

CVSS score7.2 HIGH
EPSS probability0.43%
CISA KEVNot currently listed
Published2003-02-19
Last modified2026-06-16
CVSS vectorAV:L/AC:L/Au:N/C:C/I:C/A:C

Description

The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su.

Primary references