PT-2015-3092 · Joyent+1 · Libuv+1

Saghul · Publicado 2015-05-05 · Atualizado 2023-02-12 · CVE-2015-0278

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libuv versions prior to 0.10.34

Description The issue is related to libuv not properly dropping group privileges, which allows attackers to gain privileges via unspecified vectors. The vulnerability is associated with errors in updating group privileges. Exploitation of the vulnerability may allow a remote attacker to elevate their privileges.

Recommendations For versions prior to 0.10.34, update to version 0.10.34 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

CWE-273

Identificadores relacionados

ALT-PU-2016-1086

BDU:2016-00297

CVE-2015-0278

MGASA-2015-0186

Produtos afetados

Alt Linux

Libuv

Referências · 69

• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_ccs.rb · Nota
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/nodejs_pipelining.rb · Nota
• https://github.com/rapid7/metasploit-framework/pull/2548 · Nota
• https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356 · Nota
• https://github.com/libuv/libuv/pull/215 · Nota
• https://github.com/libuv/libuv/commit/66ab38918c911bcff025562cf06237d7fedaba0c · Correção
• https://github.com/Tripwire/OpenSSL-CCS-Inject-Test · Nota
• https://nodesecurity.io/advisories/43 · Nota
• https://bdu.fstec.ru/vul/2015-05852 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-07482 · Nota de Segurança
• http://blog.nodejs.org/2014/12/23/node-v0-10-35-stable · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2015-February/150526.html · Aviso do Fabricante
• http://advisories.mageia.org/MGASA-2015-0186.html · Nota