PT-2014-9103 · Suse+2 · Suse Linux Enterprise+4
Publicado
1970-01-01
·
Atualizado
2017-01-07
·
CVE-2014-4038
CVSS v2.0
4.4
Média
| Vetor | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
ppc64-diag version 2.6.1
ppc64-diag-debugsource (affected versions not specified)
ppc64-diag-debuginfo (affected versions not specified)
Description
The issue concerns multiple vulnerabilities in the ppc64-diag package of openSUSE and SUSE Linux Enterprise operating systems. These vulnerabilities can be exploited locally, potentially leading to breaches of confidentiality, integrity, and availability of protected information. The exploitation can be related to specific files and scripts, such as
rtas errd/diag support.c, scripts/ppc64 diag mkrsrc, and lpd/test/lpd ela test.sh, which can be manipulated through symlink attacks, allowing arbitrary file overwrites.Recommendations
For ppc64-diag version 2.6.1, consider updating to a newer version that addresses these vulnerabilities.
For ppc64-diag-debugsource and ppc64-diag-debuginfo, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, consider restricting access to the vulnerable scripts and files, such as
rtas errd/diag support.c, scripts/ppc64 diag mkrsrc, and lpd/test/lpd ela test.sh, to minimize the risk of exploitation.Link Following
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Suse Linux Enterprise
Suse
Opensuse
Ppc64-Diag