PT-2019-6663 · Canonical · Ubuntu Selinux Initscript
Published
2019-04-22
·
Updated
2019-10-09
·
CVE-2011-3151
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Ubuntu SELinux initscript versions prior to 1:0.10
Description
The issue arises from the Ubuntu SELinux initscript creating a lockfile in a world-writable directory using the touch command. If the OS kernel lacks symlink protections, an attacker can exploit this to allocate a zero-byte file on any writable filesystem.
Recommendations
For Ubuntu SELinux initscript versions prior to 1:0.10, update to version 1:0.10 or later to resolve the issue.
Fix
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ubuntu Selinux Initscript