PT-2019-6657 · Gtk · Ktsuss

Publicado 2019-11-19 · Atualizado 2019-11-21 · CVE-2011-2922

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ktsuss versions 1.4 and prior

Description The issue allows a local attacker to escalate privileges to root. This can be achieved by spawning the GTK interface to run as root, potentially using the GTK MODULES environment variable to execute arbitrary code.

Recommendations For versions 1.4 and prior, consider disabling the GTK interface or restricting its use to prevent privilege escalation until a fix is available. Avoid using the GTK MODULES environment variable in sensitive environments to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-2922

Produtos afetados

Ktsuss

Referências · 8

• https://lwn.net/Articles/477678 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-2922 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-2922 · Nota de Segurança
• https://securityfocus.com/bid/49151 · Nota
• https://snyk.io/vuln/SNYK-LINUX-KTSUSS-174466 · Nota
• https://access.redhat.com/security/cve/cve-2011-2922 · Nota
• https://packetstormsecurity.com/files/109154/Gentoo-Linux-Security-Advisory-201201-15.html · Nota
• https://packetstormsecurity.com/files/cve/CVE-2011-2922 · Nota