Vulnerability CVE-2011-1675

Vulnerability Name:

CVE-2011-1675 (CCN-66705)

Assigned:

2011-03-03

Published:

2011-03-03

Updated:

2018-01-10

Summary:

mount in util-linux 2.19 and earlier attempts to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.

CVSS v3 Severity:

5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

3.3 Low (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N)
2.5 Low (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:W/RC:UR)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

3.3 Low (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N)
2.5 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:W/RC:UR)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

1.9 Low (REDHAT CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N)
1.4 Low (REDHAT Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:W/RC:UR)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-399

Vulnerability Consequences:

Bypass Security

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:linux:util-linux:2.2:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.5:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.7:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.8:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.9:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.10:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.11:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.12:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.12:pre:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.13:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.13:pre:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.14:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.15:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.16:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.17:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:2.18:*:*:*:*:*:*:*

OR cpe:/a:linux:util-linux:*:*:*:*:*:*:*:* (Version <= 2.19)

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

Configuration RedHat 5:

cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

Configuration RedHat 6:

cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

Configuration RedHat 7:

cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

Configuration RedHat 8:

cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

Configuration CCN 1:

cpe:/a:kernel:util-linux:2.19:-:*:*:*:*:*:*

AND

cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:27886	P	ELSA-2011-1691 -- util-linux-ng security, bug fix, and enhancement update (low)	2014-12-15
oval:org.mitre.oval:def:27008	P	RHSA-2011:1691 -- util-linux-ng security, bug fix, and enhancement update (Low)	2014-12-08
oval:org.mitre.oval:def:23173	P	ELSA-2012:0307: util-linux security, bug fix, and enhancement update (Low)	2014-05-26
oval:org.mitre.oval:def:21413	P	RHSA-2012:0307: util-linux security, bug fix, and enhancement update (Low)	2014-02-24
oval:com.redhat.rhsa:def:20120307	P	RHSA-2012:0307: util-linux security, bug fix, and enhancement update (Low)	2012-02-21
oval:com.redhat.rhsa:def:20111691	P	RHSA-2011:1691: util-linux-ng security, bug fix, and enhancement update (Low)	2011-12-06
oval:com.ubuntu.precise:def:20111675000	V	CVE-2011-1675 on Ubuntu 12.04 LTS (precise) - low.	2011-04-09
oval:com.ubuntu.trusty:def:20111675000	V	CVE-2011-1675 on Ubuntu 14.04 LTS (trusty) - low.	2011-04-09

BACK