CVE-2020-24330

CVE-2020-24330 affects TrouSerS (tcsd) through 0.3.14, where starting tcsd with root privileges prevents dropping the root gid when no longer needed, enabling local privilege escalation. Related issues CVE-2020-24331 and CVE-2020-24332 involve tcsd config/file permission and symlink-based DoS. Pu...

CVE-2020-24330

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed...

CVE-2020-24331

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file which contains various settings related to this daemon...

CVE-2020-24331

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file which contains various settings related to this daemon...

CVE-2020-24331

CVE-2020-24331 affects TrouSerS: when tcsd runs with root privileges, the tss user still has read/write access to /etc/tcsd.conf, enabling potential unauthorized modification of daemon settings. Root-privilege execution and file permission misconfiguration are the root causes. The CVE is discusse...

CVE-2020-24332

CVE-2020-24332 affects TrouSerS up to version 0.3.14. When tcsd runs with root privileges, creating the system.data file is prone to symlink attacks, allowing the tss user to create or corrupt files and potentially cause a DoS. A fix is available in trousers 0.3.15 (and advisories note the issues...

CVE-2020-24332

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack...

security/trousers -- several vulnerabilities

the TrouSerS project reports reports: If the tcsd daemon is started with root privileges, it fails to drop the root gid after it is no longer needed. If the tcsd daemon is started with root privileges, the tss user has read and write access to the /etc/tcsd.conf file. If the tcsd daemon is starte...