PT-2014-5146 · Nlnet+1 · Ldns+1

Publicado 2014-05-10 · Atualizado 2017-11-22 · CVE-2014-3209

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ldns versions 1.6.x

Description The issue concerns the ldns-keygen tool in ldns, which uses the current umask to set the privileges of the private key. This might allow local users to obtain the private key by reading the file.

Recommendations For ldns versions 1.6.x, consider changing the file permissions of the private key to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to the private key file to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3209

MGASA-2014-0212

USN-3491-1

Produtos afetados

Ubuntu

Ldns

Referências · 25

• https://osv.dev/vulnerability/CVE-2014-3209 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-07721 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=13324 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000231 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/05/05/4 · Nota
• https://nlnetlabs.nl/bugs-script/show_bug.cgi?id=1257 · Nota
• http://securityfocus.com/bid/67200 · Nota
• https://ubuntu.com/security/CVE-2014-3209 · Aviso do Fabricante
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746758 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3209 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000232 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-1000231 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/05/03/2 · Nota
• https://nlnetlabs.nl/bugs-script/show_bug.cgi?id=573 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3209 · Aviso do Fabricante