DebianDEBIAN:DLA-397-1:2013F[SECURITY] [DLA 397-1] ecryptfs-utils security update
8.4 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
48.6%
Package : ecryptfs-utils
Version : 83-4+squeeze2
CVE ID : CVE-2016-1572
Jann Horn discovered that the setuid-root mount.ecryptfs_private helper
in the ecryptfs-utils would mount over any target directory that the
user owns, including a directory in procfs. A local attacker could use
this flaw to escalate his privileges.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 6 | all | libecryptfs-dev | < 83-4+squeeze2 | libecryptfs-dev_83-4+squeeze2_all.deb |
| Debian | 6 | all | libecryptfs0 | < 83-4+squeeze2 | libecryptfs0_83-4+squeeze2_all.deb |
| Debian | 6 | all | ecryptfs-utils | < 83-4+squeeze2 | ecryptfs-utils_83-4+squeeze2_all.deb |
| Debian | 6 | all | ecryptfs-utils-dbg | < 83-4+squeeze2 | ecryptfs-utils-dbg_83-4+squeeze2_all.deb |
Related
8.4 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
48.6%