CVE-2001-1494

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2001-12-31 · updated 2026-06-16
Weakness: CWE-59

Description

script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.

Affected products

Avaya Cvlan: all versions
Avaya Integrated Management Suit: all versions
Avaya Interactive Response: all versions
Avaya Intuity Lx: all versions
Avaya Message Networking: all versions
Avaya Messaging Storage Server: all versions
util-linux: before 2.11n — fixed in 2.11n

How to fix

Upgrade to a fixed version: util-linux 2.11n. Check the vendor advisory for mitigations.

References

http://seclists.org/bugtraq/2001/Dec/0122.html
http://seclists.org/bugtraq/2001/Dec/0123.html
http://secunia.com/advisories/16785
http://secunia.com/advisories/18502
http://support.avaya.com/elmodocs2/security/ASA-2006-014.htm
http://www.redhat.com/support/errata/RHSA-2005-782.html
http://www.securityfocus.com/bid/16280
https://exchange.xforce.ibmcloud.com/vulnerabilities/7718
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10723
http://seclists.org/bugtraq/2001/Dec/0122.html
http://seclists.org/bugtraq/2001/Dec/0123.html
http://secunia.com/advisories/16785

Get alerted when CVE-2001-1494 or the next vulnerability affects your stack