Advisory ROSA-SA-2024-2432

2024-06-1708:57:56

ROSA LAB

abf.rosalinux.ru

man-db

rosa virtualization 2.1

local users

root privileges

setuid

setgid

gentoo

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Software: man-db 2.7.6.1
OS: ROSA Virtualization 2.1

package_evr_string: man-db-2.7.6.1

CVE-ID: CVE-2018-25078
BDU-ID: None
CVE-Crit: N/A
CVE-DESC.: man-db in Gentoo allows local users (with access to the man user account) to gain root privileges, because /usr/bin/mandb is executed by the root user, but is not owned by the root user. (In addition, the owner can remove the setuid and setgid bits.)
CVE-STATUS: Not relevant
CVE-REV: