PT-2018-10187 · Red Hat+3 · Glusterfs Server+3

Michael Hanselmann + 1 · Publicado 2018-09-04 · Atualizado 2022-04-12 · CVE-2018-10926

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glusterfs server (affected versions not specified)

Description A flaw was found in RPC request using gfs3 mknod req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Enumeração de Fraquezas

CWE-20

CWE-22

Identificadores relacionados

CESA-2018_2607

CVE-2018-10926

DLA-1510-1

DLA-1565-1

DLA-2806-1

OPENSUSE-SU-2020:0079-1

OPENSUSE-SU-2020_0079-1

RHSA-2018:2607

RHSA-2018:2608

RHSA-2018:3470

USN-4770-1

Produtos afetados

Centos

Suse

Ubuntu

Glusterfs Server

Referências · 123

• https://github.com/MauroEldritch/GEVAUDAN · Nota
• https://suse.com/security/cve/CVE-2018-1112 · Nota
• https://ubuntu.com/security/CVE-2018-10924 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-10930 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10928 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-10927 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10911 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DLA-1565-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1107027 · Nota
• https://osv.dev/vulnerability/DLA-1510-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10923 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1088 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html · Nota
• https://ubuntu.com/security/CVE-2018-10913 · Aviso do Fabricante