PT-2014-1880 · Util Linux+2 · Util-Linux+2

Published 2013-02-20 · Updated 2024-06-15 · CVE-2013-0157

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions util-linux versions 2.14.1 through 2.17.2 util-linux versions prior to 2.22.2

Description The issue allows local users to determine the existence of restricted directories by using specific command-line options or attempting to mount non-existent devices, which generates different error messages depending on whether the directory exists. Multiple vulnerabilities in the util-linux package can lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited locally.

Recommendations For util-linux versions 2.14.1 through 2.17.2, consider updating to a version prior to 2.22.2. For util-linux versions prior to 2.22.2, update to version 2.22.2 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-399

Related Identifiers

BDU:2015-09701

CESA-2013_0517

CVE-2013-0157

OPENSUSE-SU-2024:10279-1

RHSA-2013:0517

RHSA-2013_0517

Affected Products

Centos

Red Hat

Util-Linux

References · 33

• https://bdu.fstec.ru/vul/2015-09701 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:154 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0157 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0517.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0157 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-0157 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10279-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0157 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0157 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0157 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-0157 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0517.html · Vendor Advisory
• http://marc.info/?l=oss-security&m=135749410312247&w=2 · Note
• https://rhn.redhat.com/errata/RHSA-2013-0517.html · Note