Lucene search
HistoryFeb 24, 2011 - 9:00 p.m.
CVE-2011-1011
cve-2011-1011
seunshare
red hat
policycoreutils
rhel 6
fedora 14
privilege escalation
6.9 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.3%
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
Affected configurations
Node
redhatpolicycoreutilsRange≤2.0.83
ORredhatpolicycoreutilsMatch1.0
ORredhatpolicycoreutilsMatch1.1
ORredhatpolicycoreutilsMatch1.2
ORredhatpolicycoreutilsMatch1.4
ORredhatpolicycoreutilsMatch1.6
ORredhatpolicycoreutilsMatch1.8
ORredhatpolicycoreutilsMatch1.10
ORredhatpolicycoreutilsMatch1.12
ORredhatpolicycoreutilsMatch1.14
ORredhatpolicycoreutilsMatch1.16
ORredhatpolicycoreutilsMatch1.18
ORredhatpolicycoreutilsMatch1.20
ORredhatpolicycoreutilsMatch1.21.1
ORredhatpolicycoreutilsMatch1.21.2
ORredhatpolicycoreutilsMatch1.21.3
ORredhatpolicycoreutilsMatch1.21.4
ORredhatpolicycoreutilsMatch1.21.5
ORredhatpolicycoreutilsMatch1.21.6
ORredhatpolicycoreutilsMatch1.21.7
ORredhatpolicycoreutilsMatch1.21.8
ORredhatpolicycoreutilsMatch1.21.9
ORredhatpolicycoreutilsMatch1.21.10
ORredhatpolicycoreutilsMatch1.21.11
ORredhatpolicycoreutilsMatch1.21.12
ORredhatpolicycoreutilsMatch1.21.13
ORredhatpolicycoreutilsMatch1.21.14
ORredhatpolicycoreutilsMatch1.21.15
ORredhatpolicycoreutilsMatch1.21.16
ORredhatpolicycoreutilsMatch1.21.17
ORredhatpolicycoreutilsMatch1.21.18
ORredhatpolicycoreutilsMatch1.21.19
ORredhatpolicycoreutilsMatch1.21.20
ORredhatpolicycoreutilsMatch1.21.21
ORredhatpolicycoreutilsMatch1.21.22
ORredhatpolicycoreutilsMatch1.22
ORredhatpolicycoreutilsMatch1.23.1
ORredhatpolicycoreutilsMatch1.23.2
ORredhatpolicycoreutilsMatch1.23.3
ORredhatpolicycoreutilsMatch1.23.4
ORredhatpolicycoreutilsMatch1.23.5
ORredhatpolicycoreutilsMatch1.23.6
ORredhatpolicycoreutilsMatch1.23.7
ORredhatpolicycoreutilsMatch1.23.8
ORredhatpolicycoreutilsMatch1.23.9
ORredhatpolicycoreutilsMatch1.23.10
ORredhatpolicycoreutilsMatch1.23.11
ORredhatpolicycoreutilsMatch1.24
ORredhatpolicycoreutilsMatch1.25.1
ORredhatpolicycoreutilsMatch1.25.2
ORredhatpolicycoreutilsMatch1.25.3
ORredhatpolicycoreutilsMatch1.25.4
ORredhatpolicycoreutilsMatch1.25.5
ORredhatpolicycoreutilsMatch1.25.6
ORredhatpolicycoreutilsMatch1.25.7
ORredhatpolicycoreutilsMatch1.25.8
ORredhatpolicycoreutilsMatch1.25.9
ORredhatpolicycoreutilsMatch1.26
ORredhatpolicycoreutilsMatch1.27.1
ORredhatpolicycoreutilsMatch1.27.2
ORredhatpolicycoreutilsMatch1.27.3
ORredhatpolicycoreutilsMatch1.27.4
ORredhatpolicycoreutilsMatch1.27.5
ORredhatpolicycoreutilsMatch1.27.6
ORredhatpolicycoreutilsMatch1.27.7
ORredhatpolicycoreutilsMatch1.27.8
ORredhatpolicycoreutilsMatch1.27.9
ORredhatpolicycoreutilsMatch1.27.10
ORredhatpolicycoreutilsMatch1.27.11
ORredhatpolicycoreutilsMatch1.27.12
ORredhatpolicycoreutilsMatch1.27.13
ORredhatpolicycoreutilsMatch1.27.14
ORredhatpolicycoreutilsMatch1.27.15
ORredhatpolicycoreutilsMatch1.27.16
ORredhatpolicycoreutilsMatch1.27.17
ORredhatpolicycoreutilsMatch1.27.18
ORredhatpolicycoreutilsMatch1.27.19
ORredhatpolicycoreutilsMatch1.27.20
ORredhatpolicycoreutilsMatch1.27.21
ORredhatpolicycoreutilsMatch1.27.22
ORredhatpolicycoreutilsMatch1.27.23
ORredhatpolicycoreutilsMatch1.27.24
ORredhatpolicycoreutilsMatch1.27.25
ORredhatpolicycoreutilsMatch1.27.26
ORredhatpolicycoreutilsMatch1.27.27
ORredhatpolicycoreutilsMatch1.27.28
ORredhatpolicycoreutilsMatch1.27.29
ORredhatpolicycoreutilsMatch1.27.30
ORredhatpolicycoreutilsMatch1.27.31
ORredhatpolicycoreutilsMatch1.27.32
ORredhatpolicycoreutilsMatch1.27.33
ORredhatpolicycoreutilsMatch1.27.34
ORredhatpolicycoreutilsMatch1.27.35
ORredhatpolicycoreutilsMatch1.27.36
ORredhatpolicycoreutilsMatch1.27.37
ORredhatpolicycoreutilsMatch1.28
ORredhatpolicycoreutilsMatch1.29.1
ORredhatpolicycoreutilsMatch1.29.2
ORredhatpolicycoreutilsMatch1.29.3
ORredhatpolicycoreutilsMatch1.29.4
ORredhatpolicycoreutilsMatch1.29.5
ORredhatpolicycoreutilsMatch1.29.6
ORredhatpolicycoreutilsMatch1.29.7
ORredhatpolicycoreutilsMatch1.29.8
ORredhatpolicycoreutilsMatch1.29.9
ORredhatpolicycoreutilsMatch1.29.10
ORredhatpolicycoreutilsMatch1.29.11
ORredhatpolicycoreutilsMatch1.29.12
ORredhatpolicycoreutilsMatch1.29.13
ORredhatpolicycoreutilsMatch1.29.14
ORredhatpolicycoreutilsMatch1.29.15
ORredhatpolicycoreutilsMatch1.29.16
ORredhatpolicycoreutilsMatch1.29.17
ORredhatpolicycoreutilsMatch1.29.18
ORredhatpolicycoreutilsMatch1.29.19
ORredhatpolicycoreutilsMatch1.29.20
ORredhatpolicycoreutilsMatch1.29.21
ORredhatpolicycoreutilsMatch1.29.22
ORredhatpolicycoreutilsMatch1.29.23
ORredhatpolicycoreutilsMatch1.29.24
ORredhatpolicycoreutilsMatch1.29.25
ORredhatpolicycoreutilsMatch1.29.26
ORredhatpolicycoreutilsMatch1.29.27
ORredhatpolicycoreutilsMatch1.29.28
ORredhatpolicycoreutilsMatch1.30
ORredhatpolicycoreutilsMatch1.30.1
ORredhatpolicycoreutilsMatch1.30.2
ORredhatpolicycoreutilsMatch1.30.3
ORredhatpolicycoreutilsMatch1.30.4
ORredhatpolicycoreutilsMatch1.30.5
ORredhatpolicycoreutilsMatch1.30.6
ORredhatpolicycoreutilsMatch1.30.7
ORredhatpolicycoreutilsMatch1.30.8
ORredhatpolicycoreutilsMatch1.30.9
ORredhatpolicycoreutilsMatch1.30.10
ORredhatpolicycoreutilsMatch1.30.11
ORredhatpolicycoreutilsMatch1.30.12
ORredhatpolicycoreutilsMatch1.30.13
ORredhatpolicycoreutilsMatch1.30.14
ORredhatpolicycoreutilsMatch1.30.15
ORredhatpolicycoreutilsMatch1.30.16
ORredhatpolicycoreutilsMatch1.30.17
ORredhatpolicycoreutilsMatch1.30.18
ORredhatpolicycoreutilsMatch1.30.19
ORredhatpolicycoreutilsMatch1.30.20
ORredhatpolicycoreutilsMatch1.30.21
ORredhatpolicycoreutilsMatch1.30.22
ORredhatpolicycoreutilsMatch1.30.23
ORredhatpolicycoreutilsMatch1.30.24
ORredhatpolicycoreutilsMatch1.30.25
ORredhatpolicycoreutilsMatch1.30.26
ORredhatpolicycoreutilsMatch1.30.27
ORredhatpolicycoreutilsMatch1.30.28
ORredhatpolicycoreutilsMatch1.30.29
ORredhatpolicycoreutilsMatch1.30.30
ORredhatpolicycoreutilsMatch1.30.31
ORredhatpolicycoreutilsMatch1.32
ORredhatpolicycoreutilsMatch1.33.1
ORredhatpolicycoreutilsMatch1.33.2
ORredhatpolicycoreutilsMatch1.33.3
ORredhatpolicycoreutilsMatch1.33.4
ORredhatpolicycoreutilsMatch1.33.5
ORredhatpolicycoreutilsMatch1.33.6
ORredhatpolicycoreutilsMatch1.33.7
ORredhatpolicycoreutilsMatch1.33.8
ORredhatpolicycoreutilsMatch1.33.9
ORredhatpolicycoreutilsMatch1.33.10
ORredhatpolicycoreutilsMatch1.33.11
ORredhatpolicycoreutilsMatch1.33.12
ORredhatpolicycoreutilsMatch1.33.13
ORredhatpolicycoreutilsMatch1.33.14
ORredhatpolicycoreutilsMatch1.33.15
ORredhatpolicycoreutilsMatch1.33.16
ORredhatpolicycoreutilsMatch1.34.0
ORredhatpolicycoreutilsMatch1.34.1
ORredhatpolicycoreutilsMatch2.0.0
ORredhatpolicycoreutilsMatch2.0.1
ORredhatpolicycoreutilsMatch2.0.2
ORredhatpolicycoreutilsMatch2.0.3
ORredhatpolicycoreutilsMatch2.0.4
ORredhatpolicycoreutilsMatch2.0.5
ORredhatpolicycoreutilsMatch2.0.6
ORredhatpolicycoreutilsMatch2.0.7
ORredhatpolicycoreutilsMatch2.0.8
ORredhatpolicycoreutilsMatch2.0.9
ORredhatpolicycoreutilsMatch2.0.10
ORredhatpolicycoreutilsMatch2.0.11
ORredhatpolicycoreutilsMatch2.0.12
ORredhatpolicycoreutilsMatch2.0.13
ORredhatpolicycoreutilsMatch2.0.14
ORredhatpolicycoreutilsMatch2.0.15
ORredhatpolicycoreutilsMatch2.0.16
ORredhatpolicycoreutilsMatch2.0.17
ORredhatpolicycoreutilsMatch2.0.18
ORredhatpolicycoreutilsMatch2.0.19
ORredhatpolicycoreutilsMatch2.0.20
ORredhatpolicycoreutilsMatch2.0.21
ORredhatpolicycoreutilsMatch2.0.22
ORredhatpolicycoreutilsMatch2.0.23
ORredhatpolicycoreutilsMatch2.0.24
ORredhatpolicycoreutilsMatch2.0.25
ORredhatpolicycoreutilsMatch2.0.26
ORredhatpolicycoreutilsMatch2.0.27
ORredhatpolicycoreutilsMatch2.0.28
ORredhatpolicycoreutilsMatch2.0.29
ORredhatpolicycoreutilsMatch2.0.30
ORredhatpolicycoreutilsMatch2.0.31
ORredhatpolicycoreutilsMatch2.0.32
ORredhatpolicycoreutilsMatch2.0.33
ORredhatpolicycoreutilsMatch2.0.34
ORredhatpolicycoreutilsMatch2.0.35
ORredhatpolicycoreutilsMatch2.0.36
ORredhatpolicycoreutilsMatch2.0.37
ORredhatpolicycoreutilsMatch2.0.38
ORredhatpolicycoreutilsMatch2.0.39
ORredhatpolicycoreutilsMatch2.0.40
ORredhatpolicycoreutilsMatch2.0.41
ORredhatpolicycoreutilsMatch2.0.42
ORredhatpolicycoreutilsMatch2.0.43
ORredhatpolicycoreutilsMatch2.0.44
ORredhatpolicycoreutilsMatch2.0.45
ORredhatpolicycoreutilsMatch2.0.46
ORredhatpolicycoreutilsMatch2.0.47
ORredhatpolicycoreutilsMatch2.0.48
ORredhatpolicycoreutilsMatch2.0.49
ORredhatpolicycoreutilsMatch2.0.50
ORredhatpolicycoreutilsMatch2.0.51
ORredhatpolicycoreutilsMatch2.0.52
ORredhatpolicycoreutilsMatch2.0.53
ORredhatpolicycoreutilsMatch2.0.54
ORredhatpolicycoreutilsMatch2.0.55
ORredhatpolicycoreutilsMatch2.0.56
ORredhatpolicycoreutilsMatch2.0.57
ORredhatpolicycoreutilsMatch2.0.58
ORredhatpolicycoreutilsMatch2.0.59
ORredhatpolicycoreutilsMatch2.0.60
ORredhatpolicycoreutilsMatch2.0.61
ORredhatpolicycoreutilsMatch2.0.62
ORredhatpolicycoreutilsMatch2.0.63
ORredhatpolicycoreutilsMatch2.0.64
ORredhatpolicycoreutilsMatch2.0.65
ORredhatpolicycoreutilsMatch2.0.66
ORredhatpolicycoreutilsMatch2.0.67
ORredhatpolicycoreutilsMatch2.0.68
ORredhatpolicycoreutilsMatch2.0.69
ORredhatpolicycoreutilsMatch2.0.70
ORredhatpolicycoreutilsMatch2.0.71
ORredhatpolicycoreutilsMatch2.0.72
ORredhatpolicycoreutilsMatch2.0.73
ORredhatpolicycoreutilsMatch2.0.74
ORredhatpolicycoreutilsMatch2.0.75
ORredhatpolicycoreutilsMatch2.0.76
ORredhatpolicycoreutilsMatch2.0.77
ORredhatpolicycoreutilsMatch2.0.78
ORredhatpolicycoreutilsMatch2.0.79
ORredhatpolicycoreutilsMatch2.0.80
ORredhatpolicycoreutilsMatch2.0.81
ORredhatpolicycoreutilsMatch2.0.82
redhatenterprise_linuxMatch3
ORredhatenterprise_linuxMatch4
ORredhatenterprise_linuxMatch5
ORredhatenterprise_linuxMatch6.0
ORredhatfedoraMatch6
ORredhatfedoraMatch7
ORredhatfedoraMatch8
ORredhatfedoraMatch9
ORredhatfedoraMatch10
ORredhatfedoraMatch12
ORredhatfedoraMatch13
ORredhatfedoraMatch14
References
archives.neohapsis.com/archives/fulldisclosure/2011-02/0585.html
lists.fedoraproject.org/pipermail/package-announce/2011-March/056227.html
openwall.com/lists/oss-security/2011/02/23/1
openwall.com/lists/oss-security/2011/02/23/2
pkgs.fedoraproject.org/gitweb/?p=policycoreutils.git%3Ba=blob%3Bf=policycoreutils-rhat.patch%3Bh=d4db5bc06027de23d12a4b3f18fa6f9b1517df27%3Bhb=HEAD#l2197
secunia.com/advisories/43415
secunia.com/advisories/43844
secunia.com/advisories/44034
www.redhat.com/support/errata/RHSA-2011-0414.html
www.securityfocus.com/bid/46510
www.securitytracker.com/id?1025291
www.vupen.com/english/advisories/2011/0701
www.vupen.com/english/advisories/2011/0864
bugzilla.redhat.com/show_bug.cgi?id=633544
exchange.xforce.ibmcloud.com/vulnerabilities/65641
Related
nessus
nessus
Oracle Linux 6 : policycoreutils (ELSA-2011-0414)
2013-07-12 00:00:00
Fedora 14 : policycoreutils-2.0.85-19.fc14 (2011-3043)
2011-03-21 00:00:00
Scientific Linux Security Update : policycoreutils on SL6.x i386/x86_64
2012-08-01 00:00:00
prion
prion
Code injection
2011-02-24 21:00:00
openvas
openvas
RedHat Update for policycoreutils RHSA-2011:0414-01
2012-06-06 00:00:00
Fedora Update for policycoreutils FEDORA-2011-3043
2011-03-24 00:00:00
Oracle: Security Advisory (ELSA-2011-0414)
2015-10-06 00:00:00
ubuntucve
ubuntucve
CVE-2011-1011
2011-02-24 00:00:00
redhat
redhat
(RHSA-2011:0414) Important: policycoreutils security update
2011-04-04 00:00:00
oraclelinux
oraclelinux
policycoreutils security update
2011-04-04 00:00:00
cvelist
cvelist
CVE-2011-1011
2011-02-24 20:00:00
veracode
veracode
Arbitrary Code Execution
2020-04-10 01:02:58
fedora
fedora
[SECURITY] Fedora 14 Update: policycoreutils-2.0.85-19.fc14
2011-03-19 10:26:36
nvd
nvd
CVE-2011-1011
2011-02-24 21:00:18
f5
f5
SOL16876 - Mount (seunshare_mount) vulnerability CVE-2011-1101
2015-07-02 00:00:00
K16876 : Mount (seunshare_mount) vulnerability CVE-2011-1101
2015-07-02 00:00:00
6.9 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.3%
Related for CVE-2011-1011