PT-2018-4036 · Suse · Opensuse Open Build Service

Ludwig Nussel · Published 2018-06-11 · Updated 2019-10-09 · CVE-2011-4181

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SUSE open build service versions prior to 2.3 SUSE open build service version 2.1.15 and earlier

Description A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled.

Recommendations For SUSE open build service versions prior to 2.3, update to version 2.3 or later. For SUSE open build service version 2.1.15 and earlier, update to a version later than 2.1.15 or apply the necessary patches to restrict access to source files.

Fix

Improper Access Control

RCE

Weakness Enumeration

CWE-284

CWE-20

Related Identifiers

CVE-2011-4181

Affected Products

Opensuse Open Build Service

References · 6

• https://ubuntu.com/security/CVE-2011-4181 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-4181 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-4181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4181 · Security Note
• https://github.com/openSUSE/open-build-service/commit/5281e4bff9df31f1f91e22a0d1e9086b93b23d7e · Note
• https://bugzilla.suse.com/show_bug.cgi?id=734003 · Note