Vulnerability Name: | CVE-2020-15704 (CCN-186590) | ||||||||||||
Assigned: | 2020-07-22 | ||||||||||||
Published: | 2020-07-22 | ||||||||||||
Updated: | 2021-11-18 | ||||||||||||
Summary: | The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2, 2.4.7-1+2ubuntu1.16.04.3, 2.4.7-2+2ubuntu1.3, 2.4.7-2+4.1ubuntu5.1, 2.4.7-2+4.1ubuntu6. Was ZDI-CAN-11504. | ||||||||||||
CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) 4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||
CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||||||
Vulnerability Type: | CWE-20 | ||||||||||||
Vulnerability Consequences: | Obtain Information | ||||||||||||
References: | Source: MITRE Type: CNA CVE-2020-15704 Source: XF Type: UNKNOWN canonical-ubuntu-cve202015704-info-disc(186590) Source: CCN Type: Ubuntu Security Advisory USN-4449-1 Apport vulnerabilities Source: UBUNTU Type: Vendor Advisory https://ubuntu.com/security/notices/USN-4451-1 Source: UBUNTU Type: Vendor Advisory https://ubuntu.com/security/notices/USN-4451-2 Source: CCN Type: WhiteSource Vulnerability Database CVE-2020-15704 Source: CCN Type: ZDI-20-980 Canonical Ubuntu Point-to-Point Protocol Daemon Arbitrary File Read Information Disclosure Vulnerability | ||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration 4: Configuration 5: Configuration CCN 1: ![]() | ||||||||||||
BACK |