PT-2019-6663 · Canonical · Ubuntu Selinux Initscript

Publicado 2019-04-22 · Atualizado 2019-10-09 · CVE-2011-3151

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ubuntu SELinux initscript versions prior to 1:0.10

Description The issue arises from the Ubuntu SELinux initscript creating a lockfile in a world-writable directory using the touch command. If the OS kernel lacks symlink protections, an attacker can exploit this to allocate a zero-byte file on any writable filesystem.

Recommendations For Ubuntu SELinux initscript versions prior to 1:0.10, update to version 1:0.10 or later to resolve the issue.

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

Identificadores relacionados

CVE-2011-3151

Produtos afetados

Ubuntu Selinux Initscript

Referências · 2

• https://launchpadlibrarian.net/88098106/selinux_0.10~10.04.1.debdiff · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-3151 · Nota de Segurança