PT-2010-5337 · Fedora · Udev+2

Published 2010-12-07 · Updated 2022-06-03 · CVE-2010-4176

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions dracut versions on Fedora 13 and 14 udev versions on Fedora 13 and 14

Description The issue allows remote authenticated users to read terminal data from tty0 for local users due to weak permissions set for the /dev/systty device file by plymouth-pretrigger.sh in dracut and udev.

Recommendations For dracut on Fedora 13 and 14, consider updating the permissions of the /dev/systty device file to restrict access. For udev on Fedora 13 and 14, restrict access to the /dev/systty device file until a proper fix is applied.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2010-4176

Affected Products

Dracut

Plymouth-Pretrigger.Sh

Udev

References · 10

• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051755.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4176 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051418.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=654935 · Note
• http://secunia.com/advisories/42342 · Note
• http://securityfocus.com/bid/45046 · Note
• http://secunia.com/advisories/42451 · Note
• http://vupen.com/english/advisories/2010/3110 · Note
• http://vupen.com/english/advisories/2010/3062 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=654489 · Note