CVE-2004-0233: Sgi Propack

Low severity, CVSS 2.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.

Affected products

• Sgi Propack: version 2.4 only; version 3.0 only
• Slackware Slackware Linux: any version; version 9.1 only
• Utempter Utempter: version 0.5.2 only; version 0.5.3 only

Published 2004-08-18. Last modified 2026-06-16.