Lucene search

Gentoo FoundationGLSA-201412-44

HistoryDec 26, 2014 - 12:00 a.m.

policycoreutils: Privilege escalation

2014-12-2600:00:00

Gentoo Foundation

security.gentoo.org

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.2%

JSON

Background

policycoreutils is a collection of SELinux policy utilities.

Description

The seunshare utility is owned by root with 4755 permissions which can be exploited by a setuid system call.

Impact

A local attacker may be able to gain escalated privileges.

Workaround

There is no known workaround at this time.

Resolution

All policycoreutils users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose
 "&gt;=sys-apps/policycoreutils-2.2.5-r4"

OSVersionArchitecturePackageVersionFilename
Gentooanyallsys-apps/policycoreutils< 2.2.5-r4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	sys-apps/policycoreutils	< 2.2.5-r4	UNKNOWN

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.2%

JSON

Related for GLSA-201412-44