PT-2004-1096 · Gentoo Linux+1 · Aa-Sources+2

Published 2004-04-17 · Updated 2017-07-11 · CVE-2004-0133

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux versions 2.4.x aa-sources versions prior to 2.4.23-r2

Description The issue concerns an information leak in the XFS file system code in Linux, allowing local users to obtain sensitive information by reading the raw device. Additionally, there are multiple vulnerabilities in the aa-sources package of Gentoo Linux, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally.

Recommendations For Linux version 2.4.x, update to a version that fixes the information leak in the XFS file system code. For aa-sources versions prior to 2.4.23-r2, update to version 2.4.23-r2 or later to address the multiple vulnerabilities.

Fix

Related Identifiers

BDU:2015-09455

CVE-2004-0133

Affected Products

Linux

Xfs

Aa-Sources

References · 10

• http://security.gentoo.org/glsa/glsa-200407-02.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09455 · Security Note
• ftp://patches.sgi.com/support/free/security/advisories/20040405-01-U.asc · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0133 · Security Note
• http://marc.info/?l=bugtraq&m=108213675028441&w=2 · Vendor Advisory
• http://linuxsecurity.com/advisories/engarde_advisory-4285.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15901 · Note
• http://securityfocus.com/bid/10151 · Note
• http://secunia.com/advisories/11362 · Note