CVE-2004-2611: Steven Schaefer Sophster

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

The Change Permissions function in the Sophster suite before 0.9.6 28 May 2004 (aka 0.9.6-r5), possibly including Sophster, FreeSophster, and FreeSophsterPAM, removes the (1) setuid, (2) setgid, and (3) sticky bits when changing a file, which might allow attackers to gain privileges or conduct other unauthorized activities.

Affected products

• Steven Schaefer Sophster: version 0.9.5_r8 only; version 0.9.5_r10 only; version 0.9.5_r12 only; version 0.9.5_r15 only; version 0.9.6_r1 only; version 0.9.6_r2 only; …

Published 2004-12-31. Last modified 2026-06-16.