NVD

Id
8000  
Name
CVE-2011-1011  
Description
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2011-02-24  
Modified Date
2011-09-06  
Seq
2011-1011  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
45501 8000 CVE-2011-1011 20110222 Developers should not rely on the stickiness of /tmp on Red Hat Linux  View
45502 8000 CVE-2011-1011 FEDORA-2011-3043  View
45503 8000 CVE-2011-1011 [oss-security] 20110222 CVE Request  View
45504 8000 CVE-2011-1011 [oss-security] 20110223 Re: CVE Request  View
45505 8000 CVE-2011-1011 http://pkgs.fedoraproject.org/gitweb/?p=policycoreutils.git;a=blob;f=policycoreutils-rhat.patch;h=d4db5bc06027de23d12a4b3f18fa6f9b1517df27;hb=HEAD#l2197  View
45506 8000 CVE-2011-1011 RHSA-2011:0414  View
45507 8000 CVE-2011-1011 46510  View
45508 8000 CVE-2011-1011 1025291  View
45509 8000 CVE-2011-1011 ADV-2011-0701  View
45510 8000 CVE-2011-1011 ADV-2011-0864  View
45511 8000 CVE-2011-1011 policycoreutils-seunshare-symlink(65641)  View
45512 8000 CVE-2011-1011 https://bugzilla.redhat.com/show_bug.cgi?id=633544  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31209 JVNDB-2011-001449 policycoreutils パッケージの seunshare_mount 関数における権限を取得される脆弱性 policycoreutils パッケージの seunshare 内にある sandbox/seunshare.c のseunshare_mount 関数は、root の所有権およびスティッキービットの割り当てをしないまま /tmp トップ上にある新規ディレクトリのマウント処理を行うため、任意の /tmp ファイルを置き換えられたり、削除され、サービス運用妨害 (DoS) 状態となる、または権限を取得される脆弱性が存在します。 CVE-2011-1011 48918 CVE-2011-1011 8000 6.9 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001449.html 2011-02-24 2011-04-28 View