PT-2016-4964 · Veritas+1 · Base-Vxfs-51+3

Published 2016-05-14 · Updated 2016-12-01 · CVE-2016-2016

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Base-VxFS-50 versions B.05.00.01 through B.05.00.02 Base-VxFS-501 versions B.05.01.0 through B.05.01.03 Base-VxFS-51 versions B.05.10.00 through B.05.10.02

Description The issue concerns the mishandling of ACL inheritance for certain entries, including default:class:, default:other:, and default:user:. This allows local users to bypass intended access restrictions by leveraging the configuration of a parent directory.

Recommendations For Base-VxFS-50 versions B.05.00.01 through B.05.00.02, update to a version outside of this range to resolve the issue. For Base-VxFS-501 versions B.05.01.0 through B.05.01.03, update to a version outside of this range to resolve the issue. For Base-VxFS-51 versions B.05.10.00 through B.05.10.02, update to a version outside of this range to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-2016

Affected Products

Base-Vxfs-50

Base-Vxfs-501

Base-Vxfs-51

Ibm Aix

References · 4

• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121749 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2016 · Security Note
• http://securitytracker.com/id/1035816 · Note