PT-2017-6652 · Openhpi+2 · Openhpi+2

Kurt Seifried · Published 2015-11-19 · Updated 2023-02-12 · CVE-2015-3248

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenHPI versions prior to 3.6.0

Description The issue allows local users to cause a denial of service due to disk consumption by filling the filesystem hosting /var/lib. This is possible because the /var/lib/openhpi directory has world-writable permissions. A local user could use this flaw to view, modify, and delete OpenHPI-related data, or fill up the storage device hosting the /var/lib directory.

Recommendations For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider restricting write access to the /var/lib/openhpi directory to prevent unauthorized modifications and minimize the risk of disk consumption.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CESA-2015_2369

CVE-2015-3248

RHSA-2015:2369

RHSA-2015_2369

Affected Products

Centos

Openhpi

Red Hat

References · 18

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3248 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3248 · Security Note
• https://ubuntu.com/security/CVE-2015-3248 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2369.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3248 · Security Note
• http://openhpi.org/Changelogs/3.6.0 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168841.html · Vendor Advisory
• https://lists.centos.org/pipermail/centos-cr-announce/2015-November/015405.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2015-November/008715.html · Note
• https://rhn.redhat.com/errata/RHSA-2015-2369.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1233521 · Note
• https://access.redhat.com/security/cve/CVE-2015-3248 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1233520 · Note
• https://access.redhat.com/errata/RHSA-2015:2369 · Note