PT-2012-1499 · Gypsy · Gypsy

Kees Cook · Published 2012-08-13 · Updated 2013-12-13 · CVE-2011-0523

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions gypsy version 0.8

Description The issue allows local users to read otherwise restricted files due to improper restriction of files that can be read while running with root privileges.

Recommendations For version 0.8, restrict the use of gypsy when running with root privileges to minimize the risk of exploitation. Consider implementing additional access controls to limit the files that can be read by gypsy. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-0523

Affected Products

Gypsy

References · 11

• 🔥 http://cgit.freedesktop.org/gypsy/commit/?id=40101707cddb319481133b2a137294b6b669bd16 · Exploit
• http://lists.opensuse.org/opensuse-updates/2012-07/msg00034.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106927.html · Vendor Advisory
• http://secunia.com/advisories/49991 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106919.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0523 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107020.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/01/25/10 · Note
• https://bugs.freedesktop.org/show_bug.cgi?id=33431 · Note
• https://bugs.launchpad.net/ubuntu/+source/gypsy/+bug/690323 · Note
• http://openwall.com/lists/oss-security/2011/01/24/10 · Note