NVD

Id
1876  
Name
CVE-2008-1940  
Description
The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce user_transition_deny and user_transition_allow rules for the (1) sys_setfsuid and (2) sys_setfsgid calls, which allows local users to bypass restrictions for those calls.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-04-25  
Modified Date
2011-03-07  
Seq
2008-1940  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
12119 1876 CVE-2008-1940 http://www.grsecurity.org/news.php#grsec21113  View
12120 1876 CVE-2008-1940 28889  View
12121 1876 CVE-2008-1940 1019919  View
12122 1876 CVE-2008-1940 ADV-2008-1323  View
12123 1876 CVE-2008-1940 grsecurity-rbac-security-bypass(41952)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47680 JVNDB-2008-002990 grsecurity の RBAC 機能における関数の呼び出し制限を回避される脆弱性 grsecurity の RBAC 機能は、(1) sys_setfsuid および (2) sys_setfsgid 呼び出しに対して、user_transition_deny、および user_transition_allowcalls ルールを強制しないため、呼び出し制限を回避される脆弱性が存在します。 CVE-2008-1940 32053 CVE-2008-1940 1876 4.6 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002990.html 2008-04-25 2012-06-26 View