PT-2018-4212 · Parallels+1 · Vzkernel+1

Publicado 2014-06-25 · Atualizado 2018-02-27 · CVE-2014-3519

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions vzkernel versions prior to 042stab090.5

Description The issue is related to the open by handle at function in the vzkernel when using simfs. It might allow local container users with CAP DAC READ SEARCH capability to bypass an intended container protection mechanism. This could enable access to arbitrary files on a filesystem via vectors related to the use of the file handle structure.

Recommendations For vzkernel versions prior to 042stab090.5, update to version 042stab090.5 or later to resolve the issue. As a temporary workaround, consider restricting the CAP DAC READ SEARCH capability for local container users to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2014-1817

CVE-2014-3519

Produtos afetados

Alt Linux

Vzkernel

Referências · 10

• https://errata.altlinux.org/ALT-PU-2014-1817 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3519 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3519 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/06/24/16 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2014-3519 · Nota
• https://help.virtuozzo.com/customer/en/portal/articles/2563843-cu-2-6-32-042stab090-5-parallels-server-bare-metal-5-0-core-update · Aviso do Fabricante
• https://help.virtuozzo.com/customer/en/portal/articles/2522783-parallels-cloud-server-6-0-update-6-hotfix-8-6-0-6-2004- · Aviso do Fabricante
• https://openvz.org/Download/kernel/rhel6/042stab090.5 · Aviso do Fabricante
• https://help.virtuozzo.com/customer/en/portal/articles/2563842-cu-2-6-32-042stab090-5-parallels-virtuozzo-containers-4-7-core-update · Aviso do Fabricante
• http://securityfocus.com/bid/68171 · Nota