PT-2010-5660 · Debian+1 · Lvm2-Udeb+3

Alasdair Kergon + 1 · Published 1970-01-01 · Updated 2017-08-17 · CVE-2010-2526

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions lvm2 versions prior to 2.02.72 lvm2-udeb (affected versions not specified)

Description The issue affects the lvm2 package in Debian GNU/Linux and the cluster logical volume manager daemon (clvmd) in lvm2-cluster. It allows a local attacker to exploit vulnerabilities, potentially leading to a denial of service or other unspecified impacts. The exploitation can be done through crafted control commands due to the lack of client credential verification upon socket connection. This may result in the disruption of confidentiality, integrity, and availability of protected information.

Recommendations For lvm2 versions prior to 2.02.72, update to version 2.02.72 or later to resolve the issue. For lvm2-udeb, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2015-03050

BDU:2015-03051

CVE-2010-2526

DSA-2095-1

RHSA-2010:0567

RHSA-2010:0568

RHSA-2010_0567

Affected Products

Debian

Red Hat

Lvm2

Lvm2-Udeb

References · 21

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=614248 · Exploit
• https://rhn.redhat.com/errata/RHSA-2010-0567.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• http://secunia.com/advisories/40759 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03050 · Security Note
• http://vupen.com/english/advisories/2010/1944 · Vendor Advisory
• http://ubuntu.com/usn/USN-1001-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2526 · Security Note
• https://osv.dev/vulnerability/CVE-2010-2526 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03051 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2526 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2526 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2010-0568.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2526 · Security Note
• http://debian.org/security/dsa-2095 · Note