CVE-2001-0170

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2001-03-26 · updated 2026-06-16

Description

glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files.

Affected products

Conectiva Linux: 4.0, 4.0es, 4.1, 4.2, 5.0, 5.1 (+3)
Debian Linux: 2.3
Immunix: 7.0_beta
RedHat Linux: 7.0

References

http://archives.neohapsis.com/archives/bugtraq/2001-01/0131.html
http://archives.neohapsis.com/archives/bugtraq/2001-01/0186.html
http://www.redhat.com/support/errata/RHSA-2001-001.html
http://www.securityfocus.com/bid/2181
https://exchange.xforce.ibmcloud.com/vulnerabilities/5907
http://archives.neohapsis.com/archives/bugtraq/2001-01/0131.html
http://archives.neohapsis.com/archives/bugtraq/2001-01/0186.html
http://www.redhat.com/support/errata/RHSA-2001-001.html
http://www.securityfocus.com/bid/2181
https://exchange.xforce.ibmcloud.com/vulnerabilities/5907

Get alerted when CVE-2001-0170 or the next vulnerability affects your stack