PT-2018-10185 · Red Hat+4 · Glusterfs+4

Michael Hanselmann + 1 · Publicado 2018-09-04 · Atualizado 2022-04-22 · CVE-2018-10923

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions glusterfs (affected versions not specified)

Description The issue allows an authenticated attacker to create an arbitrary device and read data from any device attached to the glusterfs server node by exploiting the "mknod" call derived from mknod(2). This can be used to create files pointing to devices on a glusterfs server node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2018-2484

CESA-2018_2607

CVE-2018-10923

DLA-1510-1

DLA-2806-1

OPENSUSE-SU-2020:0079-1

OPENSUSE-SU-2020_0079-1

RHSA-2018:2607

RHSA-2018:2608

RHSA-2018:3470

USN-4770-1

Produtos afetados

Alt Linux

Centos

Suse

Ubuntu

Glusterfs

Referências · 123

• https://github.com/MauroEldritch/GEVAUDAN · Nota
• https://suse.com/security/cve/CVE-2018-1112 · Nota
• https://ubuntu.com/security/CVE-2018-10924 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-10930 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10928 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-10927 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10911 · Nota de Segurança
• https://bugzilla.suse.com/1107027 · Nota
• https://osv.dev/vulnerability/DLA-1510-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10923 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1088 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-10913 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1088 · Nota