Vulnerability Name:

CVE-2014-0595 (CCN-93889)

Assigned:2013-12-28
Published:2014-05-08
Updated:2020-02-24
Summary:/opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certain array, which allows local users to obtain the S permission in opportunistic circumstances by leveraging the granting of the F permission by an administrator.
CVSS v3 Severity:5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:2.6 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:N)
1.9 Low (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
3.6 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2014-0595

Source: SUSE
Type: UNKNOWN
SUSE-SU-2014:0847

Source: CONFIRM
Type: Vendor Advisory
http://www.novell.com/support/kb/doc.php?id=7014932

Source: BID
Type: UNKNOWN
67144

Source: CCN
Type: BID-67144
Novell Open Enterprise Server 'nwrights' Utility Local Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
novell-oes-cve20140595-priv-esc(93889)

Source: CCN
Type: Novell Knowledgebase 7010867
Patches released for Open Enterprise Server 11 Support Pack 1(OES11 SP1)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:novell:open_enterprise_server:11.0:sp2:*:*:*:linux_kernel:*:*

    • Configuration CCN 1:
  • cpe:/o:novell:open_enterprise_server:11.0:sp2:*:*:*:linux_kernel:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:55987
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:56106
    P
    		Security update for xorg-x11-server (Important)
    2021-12-14
    oval:org.opensuse.security:def:55262
    P
    		Security update for opensc (Important)
    2021-10-29
    oval:org.opensuse.security:def:20140595
    V
    		CVE-2014-0595
    2021-06-25
    oval:org.opensuse.security:def:55913
    P
    		Security update for ucode-intel (Important)
    2021-06-10
    oval:org.opensuse.security:def:57456
    P
    		Security update for libX11 (Important)
    2021-06-08
    oval:org.opensuse.security:def:56025
    P
    		Security update for libwebp (Critical)
    2021-06-02
    oval:org.opensuse.security:def:54745
    P
    		Security update for sudo (Important)
    2021-01-27
    oval:org.opensuse.security:def:57382
    P
    		Security update for gdm (Important)
    2020-12-03
    oval:org.opensuse.security:def:55821
    P
    		Security update for X Window System client libraries (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27686
    P
    		Security update for xorg-x11-libX11
    2020-12-01
    oval:org.opensuse.security:def:54605
    P
    		libspice-client-glib-2_0-8 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28793
    P
    		Security update for libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27921
    P
    		Security update for xorg-x11-libXrender
    2020-12-01
    oval:org.opensuse.security:def:54983
    P
    		perl-Tk on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27344
    P
    		libcurl4-openssl1-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28023
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:27419
    P
    		imlib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28076
    P
    		Security update for freetype2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55713
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:27629
    P
    		Security update for krb5
    2020-12-01
    oval:org.opensuse.security:def:54583
    P
    		libpango-1_0-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28758
    P
    		Security update for libpng12-0 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27770
    P
    		Security update for IBM Java
    2020-12-01
    oval:org.opensuse.security:def:27343
    P
    		curl-openssl1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27974
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:55156
    P
    		kernel-default on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27355
    P
    		wget-openssl1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28062
    P
    		Security update for exempi (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55428
    P
    		zsh on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27547
    P
    		python-lxml on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54582
    P
    		libotr5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28120
    P
    		Security update for gtk2 (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:26055
    P
    		SUSE-SU-2014:0847-1 -- Security update for novell-qtgui, novell-ui-base
    2014-09-15
    oval:org.opensuse.security:def:80090
    P
    		Security update for novell-qtgui, novell-ui-base
    2014-05-19
    BACK
    novell open enterprise server 11.0 sp2
    novell open enterprise server 11.0 sp2