PT-2008-6330 · Canonical+1 · Ecryptfs-Utils+1

Published 2008-11-21 · Updated 2017-09-29 · CVE-2008-5188

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ecryptfs-utils versions 45 through 61

Description The issue in ecryptfs-utils allows local users to obtain sensitive information by listing the process, as the ecryptfs-setup-private, ecryptfs-setup-confidential, and ecryptfs-setup-pam-wrapped.sh scripts place cleartext passwords on command lines.

Recommendations For versions 45 through 61, consider restricting access to the process list to minimize the risk of exploitation, and avoid using the scripts until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-5188

RHSA-2009:1307

RHSA-2009_1307

Affected Products

Red Hat

Ecryptfs-Utils

References · 20

• https://security-tracker.debian.org/tracker/CVE-2008-5188 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-5188 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2009-1307.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5188 · Security Note
• https://osv.dev/vulnerability/CVE-2008-5188 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2008-5188 · Note
• http://osvdb.org/50354 · Note
• http://secunia.com/advisories/32382 · Note
• https://access.redhat.com/errata/RHSA-2009:1307 · Note
• http://secunia.com/advisories/36552 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46073 · Note
• https://launchpad.net/bugs/287908 · Note
• http://openwall.com/lists/oss-security/2008/10/29/7 · Note
• http://git.kernel.org/?p=linux/kernel/git/mhalcrow/ecryptfs-utils.git%3Ba=commit%3Bh=06de99afd53f03fe07eda0ad9d61ac6d5d4d9f53 · Note
• http://osvdb.org/50353 · Note