PT-2017-13618 · P3Scan · P3Scan

Michael Orlitzky · Publicado 2017-09-21 · Atualizado 2019-10-03 · CVE-2017-14681

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions P3Scan versions 3.0 rc1 and earlier

Description The issue allows local users to potentially kill arbitrary processes by modifying the p3scan.pid file, which is created after the daemon drops privileges to a non-root account. This can be exploited before a root script executes a command to kill a process based on the pid in the p3scan.pid file.

Recommendations For P3Scan versions 3.0 rc1 and earlier, consider restricting access to the p3scan.pid file to prevent unauthorized modifications until a fix is available. Additionally, review scripts that execute commands based on the contents of the p3scan.pid file to ensure they are secure and cannot be manipulated to kill arbitrary processes.

Correção

Improper Initialization

Enumeração de Fraquezas

CWE-665

Identificadores relacionados

CVE-2017-14681

Produtos afetados

P3Scan

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-14681 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14681 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14681 · Aviso do Fabricante
• https://sourceforge.net/p/p3scan/bugs/33 · Nota
• https://cve.org/CVERecord?id=CVE-2017-14681 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-14681 · Aviso do Fabricante