NVD

Id
18839  
Name
CVE-2016-2856  
Description
pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations, related to debian/sysdeps/linux.mk. NOTE: this is not considered a vulnerability in the upstream GNU C Library because the upstream documentation has a clear security recommendation against the --enable-pt_chown option.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2016-03-13  
Modified Date
2016-11-28  
Seq
2016-2856  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
104655 18839 CVE-2016-2856 http://anonscm.debian.org/cgit/pkg-glibc/glibc.git/commit/?h=jessie&id=09f7764882a81e13e7b5d87d715412283a6ce403  View
104656 18839 CVE-2016-2856 http://anonscm.debian.org/cgit/pkg-glibc/glibc.git/commit/?h=jessie&id=11475c083282c1582c4dd72eecfcb2b7d308c958  View
104657 18839 CVE-2016-2856 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2856.html  View
104658 18839 CVE-2016-2856 http://www.halfdog.net/Security/2015/PtChownArbitraryPtsAccessViaUserNamespace/  View
104659 18839 CVE-2016-2856 [oss-security] 20160223 Access to /dev/pts devices via pt_chown and user namespaces  View
104660 18839 CVE-2016-2856 [oss-security] 20160306 Re: Access to /dev/pts devices via pt_chown and user namespaces  View
104661 18839 CVE-2016-2856 84601  View
104662 18839 CVE-2016-2856 USN-2985-1  View
104663 18839 CVE-2016-2856 USN-2985-2  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1067 JVNDB-2016-001840 Debian jessie の glibc パッケージおよび Ubuntu の elibc ならびに glibcc パッケージの pt_chown におけるキーストロークをキャプチャされる脆弱性 Debian jessie の glibc パッケージ、および Ubuntu の elibc ならびに glibcc パッケージの pt_chown は、ファイル記述子の引渡しに関連付けられた名前空間の確認が欠落しているため、キーストロークをキャプチャされ、データを偽装される、および権限を取得される脆弱性が存在します。 CVE-2016-2856 89362 CVE-2016-2856 18839 7.2 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001840.html 2016-02-16 2016-06-06 View