PT-2011-1086 · Canonical+2 · Ecryptfs-Utils-Devel+5

Publicado 2011-08-31 · Atualizado 2019-10-09 · CVE-2011-3145

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ecryptfs-utils-devel versions 75 through 82 ecryptfs-utils versions 75 through 82 ecryptfs-utils-gui versions 75 ecryptfs-utils-debuginfo versions 82

Description The issue concerns multiple vulnerabilities in the ecryptfs-utils package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally. According to the NVD, when mount.ecryptfs private before version 87-0ubuntu1.2 calls setreuid(), it doesn't also set the effective group id, resulting in the creation of mtab.tmp with the group id of the user running mount.ecryptfs private.

Recommendations For ecryptfs-utils-devel versions 75 through 82, update to a version newer than 82. For ecryptfs-utils versions 75 through 82, update to a version newer than 82. For ecryptfs-utils-gui version 75, update to a version newer than 75. For ecryptfs-utils-debuginfo version 82, update to a version newer than 82. As a temporary workaround, consider restricting access to the vulnerable mount.ecryptfs private function until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

CWE-254

Identificadores relacionados

BDU:2015-02608

BDU:2015-05975

BDU:2015-05976

BDU:2015-05977

BDU:2015-05978

BDU:2015-05979

BDU:2015-05980

BDU:2015-08749

BDU:2015-08750

BDU:2015-08751

BDU:2015-08752

BDU:2015-08753

BDU:2015-08754

CVE-2011-3145

DSA-2382-1

RHSA-2011:1241

RHSA-2011_1241

SUSE-SU-2012_0682-1

Produtos afetados

Red Hat

Suse

Ecryptfs-Utils

Ecryptfs-Utils-Debuginfo

Ecryptfs-Utils-Devel

Ecryptfs-Utils-Gui

Referências · 47

• https://bdu.fstec.ru/vul/2015-05977 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1837 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02608 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1834 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1832 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2011-1834 · Nota
• https://access.redhat.com/security/cve/CVE-2011-1835 · Nota
• http://support.novell.com/security/cve/CVE-2011-3145.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3145 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3145 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-3145 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1835 · Nota de Segurança
• https://bugzilla.novell.com/735342 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2012-June/000126.html · Nota
• https://bdu.fstec.ru/vul/2015-08752 · Nota de Segurança