CVE-2007-2063

Severity: medium (CVSS 4.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-04-18 · updated 2026-06-16
Weakness: CWE-264

Description

SSH Tectia Server for IBM z/OS before 5.4.0 uses insecure world-writable permissions for (1) the server pid file, which allows local users to cause arbitrary processes to be stopped, or (2) when _BPX_BATCH_UMASK is missing from the environment, creates HFS files with insecure permissions, which allows local users to read or modify these files and have other unknown impact.

Affected products

SSH Tectia Server: through 5.3.0; 5.0, 5.1.0, 5.2.0

References

http://osvdb.org/34998
http://secunia.com/advisories/24916
http://securitytracker.com/id?1017913
http://www.osvdb.org/35014
http://www.securityfocus.com/bid/23508
http://www.ssh.com/documents/33/SSH_Tectia_Server_5.4.0_zOS_releasenotes.txt
http://www.vupen.com/english/advisories/2007/1414
https://exchange.xforce.ibmcloud.com/vulnerabilities/33699
http://osvdb.org/34998
http://secunia.com/advisories/24916
http://securitytracker.com/id?1017913
http://www.osvdb.org/35014

Get alerted when CVE-2007-2063 or the next vulnerability affects your stack