PT-2014-9104 · Suse+2 · Suse Linux Enterprise+4

Published 1970-01-01 · Updated 2017-01-07 · CVE-2014-4039

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ppc64-diag version 2.6.1 ppc64-diag-debugsource (affected versions not specified) ppc64-diag-debuginfo (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the ppc64-diag package of openSUSE and SUSE Linux Enterprise operating systems. These vulnerabilities can be exploited locally, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, the vulnerability in ppc64-diag 2.6.1 involves the use of 0775 permissions for /tmp/diagSEsnap and inadequate restriction of permissions for /tmp/diagSEsnap/snapH.tar.gz. This allows local users to access sensitive information by reading files in the archive, such as /var/log/messages and /etc/yaboot.conf.

Recommendations For ppc64-diag version 2.6.1, consider changing the permissions of /tmp/diagSEsnap to restrict access and limit the readability of /tmp/diagSEsnap/snapH.tar.gz to authorized users. For ppc64-diag-debugsource and ppc64-diag-debuginfo, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

CWE-264

Related Identifiers

BDU:2015-04306

BDU:2015-05947

BDU:2015-05948

BDU:2015-05949

CVE-2014-4039

OPENSUSE-SU-2014_0953-1

OPENSUSE-SU-2014_0953-2

RHSA-2015:0383

RHSA-2015:1320

RHSA-2015_0383

RHSA-2015_1320

Affected Products

Red Hat

Suse Linux Enterprise

Suse

Opensuse

Ppc64-Diag

References · 25

• https://osv.dev/vulnerability/CVE-2014-4039 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1320.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00018.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05948 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-4039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04306 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4039 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05947 · Security Note
• https://bdu.fstec.ru/vul/2015-05949 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0383.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1109371 · Note
• http://openwall.com/lists/oss-security/2014/06/17/1 · Note
• http://support.novell.com/security/cve/CVE-2014-4038.html · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/JU5OH5ZTQ7RDU7QNEF2VEEDLTUZ3XRGP · Note