PT-2019-6657 · Gtk · Ktsuss

Published 2019-11-19 · Updated 2019-11-21 · CVE-2011-2922

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ktsuss versions 1.4 and prior

Description The issue allows a local attacker to escalate privileges to root. This can be achieved by spawning the GTK interface to run as root, potentially using the GTK MODULES environment variable to execute arbitrary code.

Recommendations For versions 1.4 and prior, consider disabling the GTK interface or restricting its use to prevent privilege escalation until a fix is available. Avoid using the GTK MODULES environment variable in sensitive environments to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-2922

Affected Products

Ktsuss

References · 8

• https://security-tracker.debian.org/tracker/CVE-2011-2922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2922 · Security Note
• https://lwn.net/Articles/477678 · Note
• https://securityfocus.com/bid/49151 · Note
• https://snyk.io/vuln/SNYK-LINUX-KTSUSS-174466 · Note
• https://access.redhat.com/security/cve/cve-2011-2922 · Note
• https://packetstormsecurity.com/files/109154/Gentoo-Linux-Security-Advisory-201201-15.html · Note
• https://packetstormsecurity.com/files/cve/CVE-2011-2922 · Note