PT-2014-9106 · Canonical · Ecryptfs-Utils

Marc Deslauriers · Published 1970-01-01 · Updated 2024-06-15 · CVE-2011-1836

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ecryptfs-utils versions prior to 90

Description The issue concerns multiple vulnerabilities in the ecryptfs-utils package, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally. The utils/ecryptfs-recover-private component in ecryptfs-utils does not establish a subdirectory with safe permissions, potentially allowing local users to bypass intended access restrictions via standard filesystem operations during the recovery process.

Recommendations For versions prior to 90, update to version 90 or later to resolve the issue. As a temporary workaround, consider restricting access to the ecryptfs-recover-private function to minimize the risk of exploitation. Additionally, ensure that safe permissions are established for subdirectories during the recovery process to prevent bypassing of intended access restrictions.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-04437

BDU:2015-04438

BDU:2015-04439

CVE-2011-1836

OPENSUSE-SU-2024:10118-1

Affected Products

Ecryptfs-Utils

References · 22

• https://bugzilla.redhat.com/show_bug.cgi?id=729465 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04438 · Security Note
• https://bdu.fstec.ru/vul/2015-04439 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00009.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04437 · Security Note
• https://osv.dev/vulnerability/CVE-2011-1836 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1836 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-1836 · Vendor Advisory
• http://ubuntu.com/usn/USN-1188-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10118-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1836 · Security Note
• https://github.com/torvalds/linux/commit/764355487ea220fdc2faf128d577d7f679b91f97 · Note
• https://launchpad.net/ecryptfs/+download · Note
• https://suse.com/security/cve/CVE-2011-1832 · Note
• https://suse.com/security/cve/CVE-2011-1836 · Note