PT-2014-5146 · Nlnet+1 · Ldns+1

Published 2014-05-10 · Updated 2017-11-22 · CVE-2014-3209

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ldns versions 1.6.x

Description The issue concerns the ldns-keygen tool in ldns, which uses the current umask to set the privileges of the private key. This might allow local users to obtain the private key by reading the file.

Recommendations For ldns versions 1.6.x, consider changing the file permissions of the private key to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to the private key file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3209

MGASA-2014-0212

USN-3491-1

Affected Products

Ubuntu

Ldns

References · 25

• https://osv.dev/vulnerability/CVE-2014-3209 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07721 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000231 · Security Note
• https://ubuntu.com/security/CVE-2014-3209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3209 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000232 · Security Note
• https://ubuntu.com/security/CVE-2017-1000231 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3209 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3209 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000232 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3209 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0212 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3209 · Security Note
• https://bdu.fstec.ru/vul/2022-05943 · Security Note
• https://osv.dev/vulnerability/USN-3491-1 · Vendor Advisory