Lucene search

[email protected]CVE-2016-2016

HistoryMay 14, 2016 - 3:59 p.m.

CVE-2016-2016

2016-05-1415:59:00

CWE-284

[email protected]

web.nvd.nist.gov

cve-2016-2016

vxfs

hpe

hp-ux

access restrictions

acl inheritance

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HPE HP-UX 11iv3 with VxFS 5.0, VxFS 5.0.1, and VxFS 5.1SP1 mishandles ACL inheritance for default:class: entries, default:other: entries, and default:user: entries, which allows local users to bypass intended access restrictions by leveraging the configuration of a parent directory.

CPENameOperatorVersion
hp:base-vxfs-50hp base-vxfs-50eqb.05.00.01
hp:base-vxfs-50hp base-vxfs-50eqb.05.00.02
hp:base-vxfs-501hp base-vxfs-501eqb.05.01.0
hp:base-vxfs-501hp base-vxfs-501eqb.05.01.01
hp:base-vxfs-501hp base-vxfs-501eqb.05.01.03
hp:base-vxfs-51hp base-vxfs-51eqb.05.10.00
hp:base-vxfs-51hp base-vxfs-51eqb.05.10.02

CPE	Name	Operator	Version
hp:base-vxfs-50	hp base-vxfs-50	eq	b.05.00.01
hp:base-vxfs-50	hp base-vxfs-50	eq	b.05.00.02
hp:base-vxfs-501	hp base-vxfs-501	eq	b.05.01.0
hp:base-vxfs-501	hp base-vxfs-501	eq	b.05.01.01
hp:base-vxfs-501	hp base-vxfs-501	eq	b.05.01.03
hp:base-vxfs-51	hp base-vxfs-51	eq	b.05.10.00
hp:base-vxfs-51	hp base-vxfs-51	eq	b.05.10.02

References

www.securitytracker.com/id/1035816

h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05121749

Social References

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

Related for CVE-2016-2016

prion1 cvelist1