CVE-2017-14681

The daemon in P3Scan 3.0_rc1 and earlier creates a p3scan.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for p3scan.pid modification before a root script executes a "kill `cat /pathname/p3scan.pid`" command, as demonstrated by etc/init.d/p3scan.

Score

CVSS 3.0 5.5 Medium

Status

Modified - cve@mitre.org

Published

2017-09-21

Last modified

2024-09-17

Weaknesses

CWE-665

Affected products

• P3scan (P3scan Project)

References

• https://sourceforge.net/p/p3scan/bugs/33/