Security readout for executives and security teams
Plain-English summary
P3Scan can leave a process ID file writable after it drops from root to a lower-privileged account. If someone can alter that file, a later root-run init script may terminate an unintended process. The business risk is local disruption, not a confirmed remote compromise.
Executive priority
Treat as a targeted hardening issue for legacy systems. Prioritize if P3Scan exists on shared Linux hosts or critical services could be disrupted by local process termination.
Technical view
In P3Scan 3.0_rc1 and earlier, the daemon creates p3scan.pid after privilege drop. A local user with access to the P3Scan account may modify that PID file before a root script runs a kill command based on its contents. The described impact is arbitrary process termination.
Likely exposure
Exposure appears limited to systems running P3Scan 3.0_rc1 or earlier with the affected init.d p3scan control flow. The source bundle does not identify package distributions, default permissions, or broader affected CPEs.
Exploitation context
No KEV listing or cited source confirms active exploitation. The described abuse requires local access tied to the non-root P3Scan account and a later root-run service stop or restart path that trusts p3scan.pid.
Researcher notes
The evidence is narrow: CVE text and the SourceForge bug reference describe a local PID-file trust issue. No CVSS, CWE, patch details, exploit-in-the-wild evidence, or distribution-specific advisories are provided in the bundle.
Mitigation direction
- Check whether P3Scan 3.0_rc1 or earlier is installed.
- Review vendor or project guidance for a fixed release or workaround.
- Restrict write access to the PID file and containing directory.
- Avoid root scripts that trust writable PID files.
- Replace affected init scripts where vendor guidance supports it.
Validation and detection
- Inventory hosts for P3Scan and record installed versions.
- Inspect p3scan.pid ownership and directory permissions.
- Review init.d p3scan behavior for PID-file-based process termination.
- Confirm whether service management uses a fixed vendor-provided script.
- Document any compensating controls limiting local account access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14681 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://sourceforge.net/p/p3scan/bugs/33/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.