VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 4, 2001· Updated Jun 16, 2026

CVE-2001-0946

CVE-2001-0946

Description

apmscript in Apmd in Red Hat 7.2 "Enigma" allows local users to create or change the modification dates of arbitrary files via a symlink attack on the LOW_POWER temporary file, which could be used to cause a denial of service, e.g. by creating /etc/nologin and disabling logins.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Patches

Vulnerability mechanics

Root cause

"The apmscript uses a hard-coded predictable path `/tmp/LOW_POWER` with `touch` while running as root, allowing a local attacker to pre-create a symlink to an arbitrary file."

Attack vector

A local attacker first creates a symbolic link from `/tmp/LOW_POWER` to an arbitrary target file (e.g., `/etc/nologin`). When the system enters an APM low-battery state—which occurs on laptops or special machines—the `apmscript` runs as root and executes `touch /tmp/LOW_POWER`. Because the symlink is followed, the `touch` command modifies the access/modification timestamp of the target file, or creates it if it does not exist. This allows the attacker to create or change the modification date of arbitrary files on the system [ref_id=1].

Affected code

The vulnerable script is `/etc/sysconfig/apm-scripts/apmscript` in the `apmd-3.0final-34` package on Red Hat 7.2 "Enigma". The script executes `touch /tmp/LOW_POWER` when the APM system signals a low-battery state and the `$LOWPOWER_SERVICES` variable is non-empty (defaulting to "atd crond") [ref_id=1].

What the fix does

The advisory does not include a published patch. The recommended remediation is for the vendor to modify the `apmscript` to use a safe temporary file creation method—such as using `mktemp` or writing to a directory owned by a dedicated user—rather than a hard-coded predictable path in `/tmp/`. This would prevent the symlink-following attack by ensuring the temporary file is created securely [ref_id=1].

Preconditions

  • inputThe attacker must have local access to the machine and be able to create symlinks in /tmp.
  • configThe system must be a laptop or special machine capable of signaling an APM low-battery state.
  • configThe $LOWPOWER_SERVICES variable must be non-empty (defaults to 'atd crond').
  • authThe apmscript must be executed as root (it runs as superuser).

Reproduction

1. As a local user, create a symlink: `ln -s /etc/nologin /tmp/LOW_POWER`. 2. Provoke a low-battery state on the laptop (e.g., disconnect the powerline and wait). 3. When the APM system signals the low-battery condition, `apmscript` runs as root and executes `touch /tmp/LOW_POWER`, which follows the symlink and creates `/etc/nologin`. 4. Subsequent SSH login attempts by other users fail because `/etc/nologin` exists, causing a denial of service [ref_id=1].

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.