PT-2014-9103 · Suse+2 · Suse Linux Enterprise+4

Published 1970-01-01 · Updated 2017-01-07 · CVE-2014-4038

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ppc64-diag version 2.6.1 ppc64-diag-debugsource (affected versions not specified) ppc64-diag-debuginfo (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the ppc64-diag package of openSUSE and SUSE Linux Enterprise operating systems. These vulnerabilities can be exploited locally, potentially leading to breaches of confidentiality, integrity, and availability of protected information. The exploitation can be related to specific files and scripts, such as rtas errd/diag support.c, scripts/ppc64 diag mkrsrc, and lpd/test/lpd ela test.sh, which can be manipulated through symlink attacks, allowing arbitrary file overwrites.

Recommendations For ppc64-diag version 2.6.1, consider updating to a newer version that addresses these vulnerabilities. For ppc64-diag-debugsource and ppc64-diag-debuginfo, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the vulnerable scripts and files, such as rtas errd/diag support.c, scripts/ppc64 diag mkrsrc, and lpd/test/lpd ela test.sh, to minimize the risk of exploitation.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2015-04306

BDU:2015-05947

BDU:2015-05948

BDU:2015-05949

CVE-2014-4038

OPENSUSE-SU-2014_0953-1

OPENSUSE-SU-2014_0953-2

RHSA-2015:0383

RHSA-2015:1320

RHSA-2015_0383

RHSA-2015_1320

SUSE-SU-2014_0928-1

Affected Products

Red Hat

Suse Linux Enterprise

Suse

Opensuse

Ppc64-Diag

References · 31

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4038 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4039 · Security Note
• https://osv.dev/vulnerability/CVE-2014-4038 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05948 · Security Note
• https://bdu.fstec.ru/vul/2015-04306 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05949 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4038 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0383.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4038 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-4038 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05947 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1320.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/06/17/1 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2014-July/000931.html · Note