Veracode Vulnerability DatabaseVERACODE:21141Privilege Escalation
7 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
procps-ng is vulnerable to privilege escalation. The top utility is run with HOME unset in an attacker-controlled directory, the attacker can exploit one of several vulnerabilities in the config_file() to escalate the privileges.
| CPE | Name | Operator | Version |
|---|---|---|---|
| procps-ng | eq | 3.3.10__17.el7_5.2 | |
| procps-ng | eq | 3.3.10__23.el7 |
References
seclists.org/oss-sec/2018/q2/122
www.securityfocus.com/bid/104214
access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.7_Release_Notes/index.html
access.redhat.com/errata/RHSA-2019:2189
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1692843
bugzilla.redhat.com/show_bug.cgi?id=1699264
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122
lists.debian.org/debian-lts-announce/2018/05/msg00021.html
security.gentoo.org/glsa/201805-14
usn.ubuntu.com/3658-1/
usn.ubuntu.com/3658-3/
www.debian.org/security/2018/dsa-4208
www.exploit-db.com/exploits/44806/
www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt
Related
7 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P