PT-2010-4487 · Carnegie Mellon University · Coda Filesystem Kernel Module

Publicado 2010-08-20 · Atualizado 2018-10-10 · CVE-2010-3014

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coda filesystem kernel module (affected versions not specified)

Description The issue allows local users to read sensitive heap memory. This is achieved by using a large out size value in a ViceIoctl struct to a Coda ioctl, which triggers a buffer over-read when Coda is loaded and Venus is running with /coda mounted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2010-3014

Produtos afetados

Coda Filesystem Kernel Module

Referências · 5

• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/coda/coda.h.diff?r1=1.15&r2=1.16&only_with_tag=MAIN · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-3014 · Nota de Segurança
• http://securityfocus.com/archive/1/513151/100/0/threaded · Nota
• http://svn.freebsd.org/viewvc/base?view=revision&revision=210997 · Correção
• http://vsecurity.com/resources/advisory/20100816-1 · Nota