PT-2011-3891 · Likewise · Lsass+1

Published 2011-07-27 · Updated 2017-08-29 · CVE-2011-2467

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lsass versions 5.4 through 6.1 Likewise Enterprise version 6.0

Description A SQL injection issue in lsassd in Lsass in the Likewise Security Authority allows local users to execute arbitrary SQL commands.

Recommendations For Lsass versions 5.4 through 6.1, consider restricting access to the SQL database to minimize the risk of exploitation. For Likewise Enterprise version 6.0, restrict access to the SQL database to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2011-2467

Affected Products

Likewise Enterprise

Lsass

References · 9

• http://ubuntu.com/usn/USN-1171-1 · Vendor Advisory
• http://likewise.com/community/index.php/forums/viewannounce/1212_6 · Vendor Advisory
• http://secunia.com/advisories/45326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2467 · Security Note
• http://secunia.com/advisories/45276 · Vendor Advisory
• https://bugs.launchpad.net/ubuntu/+source/likewise-open/+bug/802748 · Note
• http://securityfocus.com/bid/48816 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68765 · Note
• https://launchpadlibrarian.net/74204969/LWSA-2011-002.txt · Note