PT-2018-2299 · Linux+5 · Libcgroup+5

Matthias Gerstner

·

Publicado

2018-07-18

·

Atualizado

2021-03-15

·

CVE-2018-14348

CVSS v3.1

8.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions libcgroup up to and including 0.41
Description The issue is related to the creation of the /var/log/cgred file with mode 0666, regardless of the configured umask, leading to potential disclosure of information. This could allow a remote attacker to gain unauthorized access to information.
Recommendations For libcgroup up to and including 0.41, consider changing the permissions of the /var/log/cgred file to a more restrictive mode to minimize the risk of information disclosure. As a temporary workaround, restrict access to the /var/log/cgred file until a patch is available.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2019-2557
ALT-PU-2020-1303
ALT-PU-2020-1408
AZL-6615
BDU:2019-00427
CESA-2019_2047
CVE-2018-14348
DLA-1472-1
MGASA-2018-0380
OPENSUSE-SU-2018_2241-1
RHSA-2019:2047
RHSA-2019_2047
SUSE-SU-2018:2142-1
SUSE-SU-2018:2143-1
SUSE-SU-2018:2468-1
SUSE-SU-2018_2142-1
SUSE-SU-2018_2143-1
SUSE-SU-2018_2468-1
USN-4845-1

Produtos afetados

Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libcgroup