PT-2010-5337 · Fedora · Udev+2

Publicado 2010-12-07 · Atualizado 2022-06-03 · CVE-2010-4176

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions dracut versions on Fedora 13 and 14 udev versions on Fedora 13 and 14

Description The issue allows remote authenticated users to read terminal data from tty0 for local users due to weak permissions set for the /dev/systty device file by plymouth-pretrigger.sh in dracut and udev.

Recommendations For dracut on Fedora 13 and 14, consider updating the permissions of the /dev/systty device file to restrict access. For udev on Fedora 13 and 14, restrict access to the /dev/systty device file until a proper fix is applied.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2010-4176

Produtos afetados

Dracut

Plymouth-Pretrigger.Sh

Udev

Referências · 10

• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051755.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-4176 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051418.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=654935 · Nota
• http://secunia.com/advisories/42342 · Nota
• http://securityfocus.com/bid/45046 · Nota
• http://secunia.com/advisories/42451 · Nota
• http://vupen.com/english/advisories/2010/3110 · Nota
• http://vupen.com/english/advisories/2010/3062 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=654489 · Nota