CVE-2001-1324

CVE-2001-1324 describes a privilege escalation vulnerability in Paul Jarc's idtools before version 2001.06.27. Specifically, the cvmlogin and statfile components fail to properly validate the return value of the pathexec_env function, allowing the setstate utility to setuid to an attacker-controlled UID environment variable. This flaw enables local users to gain elevated privileges on affected systems. The vulnerability carries a CVSS score of 4.6 (MEDIUM), indicating a local attack vector with low access complexity, and potential for partial impact on confidentiality, integrity, and availability. Its low EPSS score and FAUCET Risk Score suggest a minimal likelihood of exploitation in the wild. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Furthermore, the vulnerability has received no community discussion or media coverage, indicating a low level of public awareness and interest.