PT-2008-3466 · Grsecurity · Grsecurity

Published 2008-04-24 · Updated 2017-08-08 · CVE-2008-1940

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions grsecurity versions prior to 2.1.11-2.6.24.5 grsecurity versions prior to 2.1.11-2.4.36.2

Description The issue concerns the Role-Based Access Control (RBAC) functionality, which fails to enforce specific rules for certain system calls. This allows local users to bypass restrictions related to the sys setfsuid and sys setfsgid calls.

Recommendations For grsecurity versions prior to 2.1.11-2.6.24.5, update to version 2.1.11-2.6.24.5 or later. For grsecurity versions prior to 2.1.11-2.4.36.2, update to version 2.1.11-2.4.36.2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1940

Affected Products

Grsecurity

References · 7

• http://secunia.com/advisories/29899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1940 · Security Note
• http://securityfocus.com/bid/28889 · Patch
• http://grsecurity.org/news.php#grsec21113 · Note
• http://securitytracker.com/id?1019919 · Note
• http://vupen.com/english/advisories/2008/1323/references · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41952 · Note