PT-2014-3811 · Cray · Alpsauth+3

Publicado 2014-12-27 · Atualizado 2014-12-30 · CVE-2014-0748

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions apinit on Cray devices with CLE version 4.2 before 4.2.UP02 apinit on Cray devices with CLE version 5.x before 5.1.UP00

Description The issue concerns the apinit on Cray devices, where it does not properly validate the UID in a launch message using alpsauth data. This allows local users to potentially gain privileges by modifying the aprun program.

Recommendations For apinit on Cray devices with CLE version 4.2 before 4.2.UP02, update to version 4.2.UP02 or later. For apinit on Cray devices with CLE version 5.x before 5.1.UP00, update to version 5.1.UP00 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-0748

Produtos afetados

Cle

Alpsauth

Apinit

Aprun

Referências · 2

• https://labs.mwrinfosecurity.com/advisories/2014/01/31/cray-aprunapinit-privilege-escalation · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0748 · Nota de Segurança